CVE-2012-5868: WordPress

Low severity, CVSS 2.6. EPSS: 2.4% chance of exploitation in the next 30 days.

WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.

Affected products

• WordPress WordPress: version 3.4.2 only

Published 2012-12-27. Last modified 2026-06-16.