Total vulnerabilities in the database
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
| Software | From | Fixed in |
|---|---|---|
| debian / debian_linux | 7.0 | 7.0.x |
| WordPress / wordpress | - | 3.9.1.x |
| WordPress / wordpress | 3.9.0 | 3.9.0.x |