UpHeron
All vulnerabilities

WordPress core

CVE-2008-1930

The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by registering a username that results in the same concatenated string, as demonstrated by registering usernames beginning with "admin" to obtain administrator privileges, aka a "cryptographic splicing" issue. NOTE: this…

Severity
High 7.5
Published
28 Apr 2008
Last changed
16 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Version 2.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2008-1930
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2008-1930