CVE-2016-6897 is a Cross-Site Request Forgery (CSRF) vulnerability affecting WordPress versions prior to 4.6, specifically within the wp_ajax_update_plugin function. This flaw allows remote attackers to hijack authenticated subscriber sessions to perform /dev/random read operations due to a delayed call to the check_ajax_referer function. Rated with a CVSS score of 6.5 (Medium), the vulnerability has a network attack vector and low complexity, potentially leading to high confidentiality impact. While not actively exploited in the wild (no KEV entry), Metasploit modules and an ExploitDB entry exist for related WordPress vulnerabilities, though not directly for this specific CSRF. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.5.5CPE matchmatch criteria | cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.