CVE-2016-6897 : Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update

Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.

Published 2017-01-18 21:59:00

Updated 2017-09-03 01:29:12

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2016-6897

Wordpress » Wordpress
Versions up to, including, (<=) 4.5.5
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2016-6897

Top countries where our scanners detected CVE-2016-6897

Top open port discovered on systems with this issue 80

IPs affected by CVE-2016-6897 714

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2016-6897!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2016-6897

EPSS FAQ

30.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2016-6897

WordPress Traversal Directory DoS

First seen: 2020-04-26

auxiliary/dos/http/wordpress_directory_traversal_dos

Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a lat

More information

CVSS scores for CVE-2016-6897

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2016-6897

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-6897

https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html

Summer of Pwnage - Path traversal vulnerability in WordPress Core Ajax handlers

CVEs referencing this url
https://wpvulndb.com/vulnerabilities/8606

WordPress 4.5.3 - Authenticated Denial of Service (DoS)

CVEs referencing this url
http://www.securitytracker.com/id/1036683

WordPress Bugs Let Remote Users Conduct Cross-Site Request Forgery Attacks and Remote Authenticated Users Deny Service - SecurityTracker

CVEs referencing this url
https://www.exploit-db.com/exploits/40288/

WordPress 4.5.3 - Directory Traversal / Denial of Service

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/08/20/1

oss-security - Path traversal vulnerability in WordPress Core Ajax handlers

CVEs referencing this url
http://www.securityfocus.com/bid/92572

WordPress CVE-2016-6897 Cross Site Request Forgery Vulnerability
https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568

Update/Install: Shiny Updates v2. · WordPress/WordPress@8c82515 · GitHub

Jump to

Vulnerability Details : CVE-2016-6897