WordPress Core < 4.0 - Missing Session Cookie Expiration
2012-12-27 00:00
AnonymousStrategic Overview
Vulnerability Overview
WordPress Core before 4.0 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
Technical Analysis
REMEDIATION: Update to version 4.0, or a newer patched version --- IDENTIFIER: CWE-613 (Insufficient Session Expiration) According to WASC, Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C