Published: 18/01/2017 Updated: 03/09/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress prior to 4.6 allows remote malicious users to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.

Vulnerable Product	Search on Vulmon	Subscribe to Product
wordpress wordpress

Debian Bug report logs - #837090 wordpress: CVE-2016-6896 CVE-2016-6897 Package: src:wordpress; Maintainer for src:wordpress is Craig Small <csmall@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 8 Sep 2016 17:39:02 UTC Severity: grave Tags: security, upstream Found in version wordpres ...

Path traversal vulnerability in WordPress Core Ajax handlers Abstract A path traversal vulnerability was found in the Core Ajax handlers of the WordPress Admin API This issue can (potentially) be used by an authenticated user (Subscriber) to create a denial of service condition of an affected WordPress site Contact For feedback or questions a ...

CWE-352 https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568 http://www.openwall.com/lists/oss-security/2016/08/20/1 http://www.securityfocus.com/bid/92572 https://wpvulndb.com/vulnerabilities/8606 http://www.securitytracker.com/id/1036683 https://www.exploit-db.com/exploits/40288/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837090 https://nvd.nist.gov https://www.exploit-db.com/exploits/40288/

CVE-2016-6897

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect