CVE-2016-6896 WordPress Core <= 4.5.3 - Denial of Service
HighCVSS 7.1
EPSS 38.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 4.6.1+dfsg-1 | 4.6.1+dfsg-1 |
| debian/wordpress(Debian:13) | < 4.6.1+dfsg-1 | 4.6.1+dfsg-1 |
| debian/wordpress(Debian:14) | < 4.6.1+dfsg-1 | 4.6.1+dfsg-1 |
| WordPress | = 4.5.3 | No fix listed |
| WordPress(WordPress) | < 4.6 | 4.6 |
References
- Debian Security Tracker CVE-2016-6896 vendor-advisory
- [oss-security] 20160820 Path traversal vulnerability in WordPress Core Ajax handlers mailing-list third-party-advisory
- 1036683 vdb-entry
- sumofpwn.nl exploit technical-description third-party-advisory
- wpvulndb.com
- 40288 exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking