WordPress Core — Informational < 6.8 - Weak Hashing Algorithm

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WordPress.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 6.8, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch WordPress to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence.

Versions of WordPress core older than version 6.8 use a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. Jun 20, 2012

   CVE published

   Severity low, CVSS 3.7

2. Nov 13, 2026

   Record last updated