# CVE-2016-6897: WordPress CSRF and Path Traversal in wp_ajax_update_plugin

Source: https://junglewise.ai/threats/cve-2016-6897-wordpress-csrf-and-path-traversal-in-wp-ajax-update-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-6897 · Severity: medium · CVSS 6.5 · Published 2017-01-18

A security flaw in WordPress allows attackers to trick logged-in users into performing unintended actions. By exploiting this, an attacker could force a user's browser to read sensitive system files or exhaust server resources, potentially leading to a website crash or service outage. This issue affects sites running WordPress versions earlier than 4.6.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2016-6897 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-6897 being exploited in the wild.

**How severe is CVE-2016-6897?** Medium severity, with a CVSS score of 6.5, published 18 January 2017.

**Which products and versions are affected?** WordPress WordPress before 4.6.

**Is there a fix for CVE-2016-6897?** A patch was published on 2016-06-15: Fixed in WordPress core commit 8c82515ab62b88fb32d01c9778f0204b296f3568 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-6897 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-6897?** Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the `wp_ajax_update_plugin` function within `wp-admin/includes/ajax-actions.php`. The root cause is a late call to the `check_ajax_referer` function, which occurs after the application has already processed a path traversal-vulnerable input. An attacker can leverage this to force a logged-in user (even with low privileges like a Subscriber) to trigger a read operation on arbitrary files such as `/dev/random`. Repeatedly reading from `/dev/random` can deplete the system's entropy pool, causing the server to block and resulting in a Denial of Service (DoS). The vulnerability is fixed in WordPress version 4.6 by moving the security and nonce checks to the beginning of the affected method.

## Affected products

- WordPress WordPress before 4.6

## Timeline

- 2016-06-15: patched: Fixed in WordPress core commit 8c82515ab62b88fb32d01c9778f0204b296f3568
- 2016-08-20: disclosed: Public disclosure via Summer of Pwnage project
- 2017-01-18: advisory: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2016/08/20/1](http://www.openwall.com/lists/oss-security/2016/08/20/1)
- [http://www.securityfocus.com/bid/92572](http://www.securityfocus.com/bid/92572)
- [http://www.securitytracker.com/id/1036683](http://www.securitytracker.com/id/1036683)
- [https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568](https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568)
- [https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html](https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html)
- [https://wpvulndb.com/vulnerabilities/8606](https://wpvulndb.com/vulnerabilities/8606)
- [https://www.exploit-db.com/exploits/40288/](https://www.exploit-db.com/exploits/40288/)

## Related threats

- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)
- [WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt)
- [WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling)