# CVE-2016-10148: WordPress improper access control in wp_ajax_update_plugin

Source: https://junglewise.ai/threats/cve-2016-10148-wordpress-improper-access-control-in-wp-ajax-update-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-10148 · Severity: medium · CVSS 4.3 · Published 2017-01-18

WordPress, a popular website management platform, contains a security flaw in how it handles plugin updates. An authorized user with low-level access (such as a Subscriber) can bypass security checks to view sensitive plugin data they should not be able to see. This could allow an attacker to gather information about the site's configuration or potentially cause a service disruption.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2016-10148 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10148 being exploited in the wild.

**How severe is CVE-2016-10148?** Medium severity, with a CVSS score of 4.3, published 18 January 2017.

**Which products and versions are affected?** WordPress WordPress before 4.6.

**Is there a fix for CVE-2016-10148?** A patch was published on 2016-08-16: Fixed in WordPress version 4.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10148 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-10148?** Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress versions prior to 4.6 contains an improper access control vulnerability. The function calls get_plugin_data() before verifying the 'update_plugins' capability or validating CSRF tokens. A remote authenticated attacker, even with low privileges like a Subscriber, can exploit this by sending a crafted request to wp-admin/admin-ajax.php with a specific plugin parameter. This allows the attacker to bypass intended read-access restrictions and potentially trigger a path traversal or denial of service condition. The issue was addressed in WordPress 4.6 by moving capability and CSRF checks to the beginning of the affected AJAX handlers.

## Affected products

- WordPress WordPress before 4.6

## Timeline

- 2016-07-12: disclosed: Vulnerability discovered by Yorick Koster
- 2016-08-16: patched: Fixed in WordPress version 4.6
- 2017-01-18: advisory: NVD published CVE-2016-10148

## References

- [http://www.openwall.com/lists/oss-security/2016/08/20/1](http://www.openwall.com/lists/oss-security/2016/08/20/1)
- [http://www.securityfocus.com/bid/96847](http://www.securityfocus.com/bid/96847)
- [https://core.trac.wordpress.org/changeset/38168](https://core.trac.wordpress.org/changeset/38168)
- [https://core.trac.wordpress.org/ticket/37490](https://core.trac.wordpress.org/ticket/37490)
- [https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html](https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html)

## Related threats

- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)
- [WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt)
- [WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling)