CVE Feed

    Dashboard / CVE / CVE-2016-6897

    CVE-2016-6897

    Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.

    Published:Jan 18, 2017
    Last Modified:Apr 20, 2025
    EPS:Jan 18, 2017
    EPSS Score:0.29012
    CVSS Score:6.5

    Affected Products

    Vendor
    Wordpress
    Product
    Wordpress

    Exploits

    https://www.exploit-db.com/exploits/40288

    Related CVEs

    CVE-2026-77807 (CVSS 7.5) — The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for Word…
    CVE-2026-84821 (CVSS 7.5) — Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.…
    CVE-2026-84819 (CVSS 7.1) — Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.…
    CVE-2026-84816 (CVSS 7.1) — Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.…
    CVE-2026-81803 (CVSS 7.5) — Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.…
    CVE-2026-81799 (CVSS 7.5) — Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.…
    CVE-2026-81796 (CVSS 7.3) — Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions.…
    CVE-2026-81793 (CVSS 6.5) — Unauthenticated Broken Access Control in Salon booking system <= 10.31.5 versions.…
    CVE-2026-81788 (CVSS 6.3) — Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.…
    CVE-2026-81787 (CVSS 6.5) — Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.…

    References

    http://www.openwall.com/lists/oss-security/2016/08/20/1
    http://www.securityfocus.com/bid/92572
    http://www.securitytracker.com/id/1036683
    https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568
    https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html
    https://wpvulndb.com/vulnerabilities/8606
    https://www.exploit-db.com/exploits/40288/
    http://www.openwall.com/lists/oss-security/2016/08/20/1
    http://www.securityfocus.com/bid/92572
    http://www.securitytracker.com/id/1036683
    https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568
    https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html
    https://wpvulndb.com/vulnerabilities/8606
    https://www.exploit-db.com/exploits/40288/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High