CVE-2013-2173: wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attac...

Security readout for executives and security teams

CVE-2013-2173 is a denial-of-service issue in WordPress 3.5.1. If a site has a password-protected post, a remote attacker could send specially formed cookie data that makes the server spend excessive CPU. The impact is availability, not data theft, and the evidence provided does not show active exploitation. Exposure is most likely on legacy WordPress 3.5.1 installations with at least one password-protected post. Modern WordPress deployments should only be exposed if they are unpatched or running an affected downstream package. Treat this as a cleanup priority for legacy WordPress assets. It is not currently evidenced as actively exploited, but internet-facing unpatched sites could suffer availability loss from low-effort remote traffic. Mitigation focus: Upgrade WordPress 3.5.1 sites to WordPress 3.5.2 or later.; Apply Debian or other distribution security updates where WordPress is packaged.; Check vendor or package maintainer guidance for backported fixes..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.