CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.

• CWE-94

• http://codex.wordpress.org/Version_3.6.1Vendor Advisory
• http://core.trac.wordpress.org/changeset/25325Exploit, Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.html
• http://wordpress.org/news/2013/09/wordpress-3-6-1/Patch, Vendor Advisory
• http://www.debian.org/security/2013/dsa-2757
• http://codex.wordpress.org/Version_3.6.1Vendor Advisory
• http://core.trac.wordpress.org/changeset/25325Exploit, Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.html
• http://wordpress.org/news/2013/09/wordpress-3-6-1/Patch, Vendor Advisory
• http://www.debian.org/security/2013/dsa-2757

Published

Sep 12, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4332Multiple integer overflows in malloc/malloc.c in the GNU C L…
• CVE-2013-4333OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5…9.1
• CVE-2013-4334opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities9.8
• CVE-2013-4335opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multip…9.8
• CVE-2013-4336Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4337Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-4339WordPress before 3.6.1 does not properly validate URLs befor…
• CVE-2013-4340wp-admin/includes/post.php in WordPress before 3.6.1 allows …
• CVE-2013-4341Multiple cross-site scripting (XSS) vulnerabilities in Moodl…
• CVE-2013-4342xinetd does not enforce the user and group configuration dir…
• CVE-2013-4343Use-after-free vulnerability in drivers/net/tun.c in the Lin…
• CVE-2013-4344Buffer overflow in the SCSI implementation in QEMU, as used …