CVE-2016-6896

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/08/20/1Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1036683
https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.htmlExploit, Technical Description, Third Party Advisory
https://wpvulndb.com/vulnerabilities/8606
https://www.exploit-db.com/exploits/40288/
http://www.openwall.com/lists/oss-security/2016/08/20/1Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1036683
https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.htmlExploit, Technical Description, Third Party Advisory
https://wpvulndb.com/vulnerabilities/8606
https://www.exploit-db.com/exploits/40288/

Timeline

Published: Jan 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-68976.5Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef CVE-2016-68986.6XML external entity (XXE) vulnerability in the Hyper Management Module (HMM) in Huawei E9000 rack servers with software before V100R001C00SP CVE-2016-68997.5The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers CVE-2016-69005.5The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613; RH2288 V3 servers CVE-2016-69016.5Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with soft CVE-2016-69029.9lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.CVE-2016-69039.9lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.CVE-2016-69048.1Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could al CVE-2016-69056.5The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of ser CVE-2016-69065.5The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of ser CVE-2016-69086.1Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, due CVE-2016-69099.8Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch befo