# CVE-2016-6896: WordPress directory traversal in wp_ajax_update_plugin

Source: https://junglewise.ai/threats/cve-2016-6896-wordpress-directory-traversal-in-wp-ajax-update-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-6896 · Severity: high · CVSS 7.1 · Published 2017-01-18

A vulnerability in WordPress, a popular website management platform, allows logged-in users with low privileges to disrupt the site's availability. By exploiting a flaw in how the system handles plugin updates, an attacker can force the server to perform resource-intensive tasks that lead to a denial-of-service condition. This can result in the website becoming unresponsive to legitimate visitors, potentially impacting business operations and reputation.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2016-6896 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-6896 being exploited in the wild.

**How severe is CVE-2016-6896?** High severity, with a CVSS score of 7.1, published 18 January 2017.

**Which products and versions are affected?** WordPress WordPress 4.5.3.

**Is there a fix for CVE-2016-6896?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-6896 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-6896?** Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability exists in the 'wp_ajax_update_plugin' function within 'wp-admin/includes/ajax-actions.php'. The root cause is that the 'plugin' parameter is used to retrieve version information before the application performs capability checks or CSRF nonce validation. An authenticated attacker (even with 'Subscriber' privileges) can provide a path like '../../../../dev/random' to deplete the server's entropy pool, causing PHP processes to block and leading to a Denial of Service (DoS). Additionally, the flaw can be used to read the first 8KB of files that contain a 'Version:' string. The issue is mitigated in WordPress 4.6 by moving security checks to the beginning of the affected method.

## Affected products

- WordPress WordPress 4.5.3

## Timeline

- 2016-07-12: other: Vulnerability discovered during Summer of Pwnage event
- 2016-08-20: disclosed: Public disclosure via oss-security mailing list
- 2016-08-22: other: Exploit code published on Exploit-DB
- 2017-01-18: advisory: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2016/08/20/1](http://www.openwall.com/lists/oss-security/2016/08/20/1)
- [http://www.securitytracker.com/id/1036683](http://www.securitytracker.com/id/1036683)
- [https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html](https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html)
- [https://wpvulndb.com/vulnerabilities/8606](https://wpvulndb.com/vulnerabilities/8606)
- [https://www.exploit-db.com/exploits/40288/](https://www.exploit-db.com/exploits/40288/)

## Related threats

- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)
- [WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt)
- [WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling)