WordPress <=4.0 Denial of Service Exploit (CVE-2014-9034)

[john@xxxxxxxxxxxx]

author details: John M. (john@xxxxxxxxxxxx)
homepage details: SECURELI.com

Description:

CVE-2014-9034 was published recently, highlighting an issue that ?allows remote 
attackers to cause a denial of service (CPU consumption) via a long password 
that is improperly handled during hashing? due to phpass usage.

After reviewing the vulnerability, I have developed a proof-of-concept that 
successfully performs a denial of service attack against 
wp-includes/class-phpass.php in the affected version numbers:

    before 3.7.5
    3.8.x before 3.8.5
    3.9.x before 3.9.3
    4.x before 4.0.1

There is no other working code published out in the security world that allows 
replicating the denial of service code, so this is an exclusive world premier. 
:)

The proof of concept is developed in PHP and is available for download here:

http://secureli.com/wp-content/uploads/2014/11/secureli.com-wordpressed.php_.txt

-John