CVE-2012-3384: Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

medium Affects WordPress core. Feed 2026.10.28.3, updated 2026-10-28; published 2012-07-22; advisory modified 2026-06-16.

Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Package: WordPress core WordPress
Affected versions: <=3.4.0 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.2 or =3.3.3
Fixed in: no fix recorded
Severity: medium CVSS 6.8
Exploitation: not on CISA KEV · EPSS 1% (69.1th percentile)
Published: 2012-07-22
Source: nvd

References

CWE-352

NVD record WordPress core advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2026-63030 KEV critical WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoi same package: WordPress core
CVE-2026-60137 KEV medium WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly same package: WordPress core
CVE-2022-21661 high WordPress is a free and open-source content management system written in PHP and paired wi same package: WordPress core
CVE-2019-8943 medium WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has pri same package: WordPress core
CVE-2017-5487 medium wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implemen same package: WordPress core
CVE-2021-29447 high Wordpress is an open source CMS. A user with the ability to upload files (like an Author) same package: WordPress core