wordpress wordpress 4.7.1 vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x prior to 4.7.2 does not require an integer identifier, which allows remote malicious users to modify arbitrary pages via a request for wp-json/wp/v...

Wordpress Wordpress 4.7.1 Wordpress Wordpress 4.7 Wordpress Wordpress 4.7.2

1 Nmap script3 Github repositories

7.5

CVSSv3

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

Wordpress Wordpress 4.7.5 Wordpress Wordpress 4.8 Wordpress Wordpress 4.7.3 Wordpress Wordpress 4.7.4 Wordpress Wordpress 4.7 Wordpress Wordpress 4.8.1 Wordpress Wordpress 4.7.1 Wordpress Wordpress 4.7.2

5.3

CVSSv3

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 prior to 4.7.1 does not properly restrict listings of post authors, which allows remote malicious users to obtain sensitive information via a wp-json/wp/v2/users requ...

Wordpress Wordpress

1 EDB exploit21 Github repositories

8.8

CVSSv3

Cross-site request forgery (CSRF) vulnerability in WordPress prior to 4.7.1 allows remote malicious users to hijack the authentication of unspecified victims via vectors involving a Flash file upload.

Wordpress Wordpress

5.3

CVSSv3

wp-mail.php in WordPress prior to 4.7.1 might allow remote malicious users to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.

Wordpress Wordpress

6.1

CVSSv3

Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress prior to 4.7.1 allow remote malicious users to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.

Wordpress Wordpress

7.5

CVSSv3

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress prior to 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote malicious users to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

Wordpress Wordpress

6.1

CVSSv3

Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress prior to 4.7.1 allows remote malicious users to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includ...

Wordpress Wordpress

1 Github repository

8.8

CVSSv3

Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress prior to 4.7.1 allows remote malicious users to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/in...

Wordpress Wordpress

2 Github repositories

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook