WordPress · Wordpress · CVE-2014-9033
**Name of the Vulnerable Software and Affected Versions**
WordPress versions 3.7.4, 3.8.4, 3.9.2, and 4.0
**Description**
A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of arbitrary users for requests that reset passwords. This occurs in the wp-login.php file.
**Recommendations**
For WordPress version 3.7.4, update to a version that includes the fix for this issue.
For WordPress version 3.8.4, update to a version that includes the fix for this issue.
For WordPress version 3.9.2, update to a version that includes the fix for this issue.
For WordPress version 4.0, update to a version that includes the fix for this issue.