CVE-2012-6707

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://core.trac.wordpress.org/ticket/21022Issue Tracking, Patch, Vendor Advisory
https://core.trac.wordpress.org/ticket/21022Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Oct 19, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-67086.1jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from CVE-2012-67095.9ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.CVE-2012-67109.8ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an actio CVE-2012-67117.8A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE env CVE-2012-67129.8In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory cor CVE-2012-67136.1The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.CVE-2012-67146.1The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.CVE-2012-67156.1The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.CVE-2012-67166.1The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.CVE-2012-67176.1The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.CVE-2012-67186.1The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.CVE-2012-67199.8The sharebar plugin before 1.2.2 for WordPress has SQL injection.