Is CVE-2016-6897 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-6897 being exploited in the wild.

How severe is CVE-2016-6897?

Medium severity, with a CVSS score of 6.5, published 18 January 2017.

Which products and versions are affected?

WordPress WordPress before 4.6.

Is there a fix for CVE-2016-6897?

A patch was published on 2016-06-15: Fixed in WordPress core commit 8c82515ab62b88fb32d01c9778f0204b296f3568 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-6897 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2016-6897?

Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-6897: WordPress CSRF and Path Traversal in wp_ajax_update_plugin

CVE-2016-6897 · Severity: medium · CVSS 6.5 · Published 2017-01-18

A security flaw in WordPress allows attackers to trick logged-in users into performing unintended actions. By exploiting this, an attacker could force a user's browser to read sensitive system files or exhaust server resources, potentially leading to a website crash or service outage. This issue affects sites running WordPress versions earlier than 4.6.

Technologies: Wordpress. Vendors: Wordpress.

Quick answers

Is CVE-2016-6897 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-6897 being exploited in the wild.
How severe is CVE-2016-6897?: Medium severity, with a CVSS score of 6.5, published 18 January 2017.
Which products and versions are affected?: WordPress WordPress before 4.6.
Is there a fix for CVE-2016-6897?: A patch was published on 2016-06-15: Fixed in WordPress core commit 8c82515ab62b88fb32d01c9778f0204b296f3568 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-6897 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2016-6897?: Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the `wp_ajax_update_plugin` function within `wp-admin/includes/ajax-actions.php`. The root cause is a late call to the `check_ajax_referer` function, which occurs after the application has already processed a path traversal-vulnerable input. An attacker can leverage this to force a logged-in user (even with low privileges like a Subscriber) to trigger a read operation on arbitrary files such as `/dev/random`. Repeatedly reading from `/dev/random` can deplete the system's entropy pool, causing the server to block and resulting in a Denial of Service (DoS). The vulnerability is fixed in WordPress version 4.6 by moving the security and nonce checks to the beginning of the affected method.

Affected products

WordPress WordPress before 4.6

Timeline

2016-06-15: patched: Fixed in WordPress core commit 8c82515ab62b88fb32d01c9778f0204b296f3568
2016-08-20: disclosed: Public disclosure via Summer of Pwnage project
2017-01-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.