Skip to content
Fencer Intel
medium 5.0

CVE-2012-0937 json

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to e…

published 2012-01-30 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-0960

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.6%
EPSS 7.6% chance of exploitation in 30 days, percentile 94%
public exploits
1
Exploit-DB

Summary

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time

Timeline

  1. First public exploit (EDB-18417)
  2. Published

Exploit prediction

7.63% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-18417 WordPress Core 3.3.1 - Multiple Vulnerabilities webapps, 2012-01-25
  • archives.neohapsis.com http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.