Vulnerability record · CVE-2014-9034 · published 25 November 2014
CVE-2014-9034: WordPress phpass long password hashing CPU denial of service
Wordpress · Wordpress
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 mishandles long passwords during hashing, causing excessive CPU consumption. The flaw is similar to CVE-2014-9016 and lets remote attackers degrade or exhaust server CPU.
Description
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityNetwork-reachable, unauthenticated denial of service with a very high EPSS score, though impact is limited to availability and no KEV listing or public exploit tag is present.
What it is
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 mishandles long passwords during hashing, causing excessive CPU consumption. The flaw is similar to CVE-2014-9016 and lets remote attackers degrade or exhaust server CPU.
Impact
An attacker can drive high CPU usage on the WordPress host, slowing or denying service to legitimate users. No confidentiality or integrity impact is described; the effect is availability only.
Attack surface
Reachable over the network via the authentication or password-hashing path that processes a supplied password, per the AV:N/AC:L/Au:N vector. No authentication or user interaction is required according to the CVSS vector.
Exploitation
Not listed in CISA KEV and no exploit tag appears in the references, but EPSS is very high (0.82702, 99.65th percentile), indicating substantial predicted exploitation activity.
What to do
- Upgrade WordPress to 3.7.5, 3.8.5, 3.9.3, 4.0.1 or later as applicable.
- Apply the vendor patch referenced in the WordPress 4.0.1 release and changeset 30467.
- Apply distribution backports (Debian DSA-3085, Mageia MGASA-2014-0493, Mandriva MDVSA-2014:233) where the platform package is used.
- Enforce request body and password length limits at the web server or WAF to cap oversized password inputs.
- Monitor CPU and request rates on WordPress hosts and rate-limit authentication endpoints.
Detection
- Alert on unusually long password values or oversized POST bodies to login, registration and password-reset endpoints.
- Monitor sustained CPU spikes on WordPress hosts correlated with authentication requests.
- Baseline and alert on abnormal request rates to wp-login.php and related hashing paths from single sources.
- Review web server logs for repeated large-payload requests to authentication endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-9034 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-9034), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
