{"id":"CVE-2016-6897","title":"Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef","published":"2017-01-18T17:59:00.307Z","updated":"2026-06-16T20:51:57.313Z","severity":"medium","cvssScore":6.5,"epss":0.2882,"epssPct":0.98177,"kev":false,"maturity":"weaponized","actionScore":60,"primaryVendor":"wordpress","primaryProduct":"wordpress","cweId":"CWE-352","fixAvailable":true,"tags":["pre-auth","csrf","remote"],"epssDelta7":0.0056,"summary":"Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Cross-Site Request Forgery (CSRF)","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-06T01:43:38.559Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:49:17.954Z","exploitdb":"2026-11-13T03:17:58.683Z","metasploit":"2026-11-13T03:18:09.107Z"},"cvssCna":null,"hasPatchRef":true,"credits":[],"counts":{"exploitdb":1,"metasploit":1,"nuclei":0,"githubPoc":0},"products":[{"vendor":"wordpress","product":"wordpress","cpe":"cpe:2.3:a:wordpress:wordpress"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/08/20/1","tags":null},{"url":"http://www.securityfocus.com/bid/92572","tags":null},{"url":"http://www.securitytracker.com/id/1036683","tags":null},{"url":"https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568","tags":null},{"url":"https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html","tags":null},{"url":"https://wpvulndb.com/vulnerabilities/8606","tags":null}],"exploits":[{"source":"exploitdb","kind":"webapps","date":"2016-08-22"},{"source":"metasploit","kind":"auxiliary","date":null}],"analysis":null,"affectedVersions":[{"vendor":"wordpress","product":"wordpress","version":"*","vsi":null,"vse":null,"vei":"4.5.5","vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}