Vulnerability Details : CVE-2014-5203
wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.
Vulnerability category: Execute code
Threat overview for CVE-2014-5203
Top countries where our scanners detected CVE-2014-5203
Top open port discovered on systems with this issue
22
IPs affected by CVE-2014-5203 2
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2014-5203!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2014-5203
Probability of exploitation activity in the next 30 days: 7.16%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 93 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-5203
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2014-5203
-
https://wordpress.org/news/2014/08/wordpress-3-9-2/
News – WordPress 3.9.2 Security Release – WordPress.orgPatch;Vendor Advisory
-
https://core.trac.wordpress.org/changeset/29389
Changeset 29389 – WordPress Trac
-
http://openwall.com/lists/oss-security/2014/08/13/3
oss-security - Re: WordPress 3.9.2 release - needs CVE's
Products affected by CVE-2014-5203
- cpe:2.3:a:wordpress:wordpress:3.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*