CVE-2012-1936

CVE-2012-1936 describes a Cross-Site Request Forgery (CSRF) vulnerability in WordPress versions 3.3.1 and earlier, stemming from the wp_create_nonce function associating nonces with user accounts rather than sessions. This design flaw could allow remote attackers to conduct CSRF attacks on specific administrative actions by sniffing network traffic. The vulnerability has a CVSS score of 6.8 (Medium), indicating it can be exploited over the network with medium complexity, potentially leading to partial confidentiality, integrity, and availability impacts. While the vendor reportedly disputes its significance, exploit code is publicly available via ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.