CVE-2007-6013

9.8 criticalEPSS 3.3%

Critical (9.8). EPSS 3.3% chance of exploitation in the next 30 days.

Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-327
Published: 2007-11-19
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

fedoraproject:fedora
wordpress:wordpress

References

http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058576.html
http://osvdb.org/40801
http://secunia.com/advisories/27714
http://secunia.com/advisories/28310
http://securityreason.com/securityalert/3375

Check your stack JSON