UpHeron
All vulnerabilities

WordPress core

CVE-2016-6896

Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.

Severity
High 7.1
Published
18 Jan 2017
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Version 4.5.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-6896
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-6896