CWE Code: 312
Vulnerability Type: sql_injection
CVSS Score: 4.0
CWE Name:  Cleartext Storage of Sensitive Information
Summary: wordpress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified sql injection vulnerability).
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2017-10-03
Last Modified Date: 2019-10-03