CVE-2014-0166 Auth bypass in n/a

What is CVE-2014-0166?

CVE-2014-0166 is a medium-severity authentication bypass vulnerability in Wordpress Wordpress, published on 9 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.

Weakness: CWE-287

Which versions are affected by CVE-2014-0166?

It affects 1 product.

Products include Wordpress Wordpress.

How do I fix CVE-2014-0166?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2014-0166 being exploited?

There is no known exploitation of CVE-2014-0166 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Wordpress Wordpress

• CVE-2026-63030 WordPress Core Interpretation Conflict Exploited Critical 9.8
• CVE-2026-87902 WordPress Core Remote File Inclusion Exploited High 8.1
• CVE-2026-60137 WordPress Core SQL Injection Exploited Medium 5.9
• CVE-2012-2399 Cross-site scripting in n/a Critical 10.0
• CVE-2012-2400 Other in n/a Critical 10.0

All Wordpress Wordpress vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-0166, GHSA-jg4j-hqh7-5qcx.