CVE-2017-14990

CVE-2017-14990 describes a vulnerability in WordPress 4.8.2 where activation keys for unactivated user accounts (wp_signups.activation_key) are stored in cleartext, unlike the hashed keys for existing users. This flaw could allow an attacker with database read access, potentially gained through an SQL injection, to hijack unactivated user accounts. Rated Medium severity (CVSS 6.5), the vulnerability requires low privileges and network access, with a high impact on confidentiality. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.