# CVE-2017-5492: WordPress CSRF in widget-editing accessibility mode

Source: https://junglewise.ai/threats/cve-2017-5492-wordpress-csrf-in-widget-editing-accessibility-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-15. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5492 · Severity: high · CVSS 8.8 · Published 2017-01-15

WordPress, a popular website management and blogging platform, was found to have a security flaw in its widget-editing accessibility feature. This vulnerability could allow an attacker to trick a logged-in administrator into performing unintended actions, such as modifying or deleting website widgets. If successfully exploited, this could lead to unauthorized changes to the website's appearance or functionality, potentially impacting the site's reputation and user experience.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2017-5492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5492 being exploited in the wild.

**How severe is CVE-2017-5492?** High severity, with a CVSS score of 8.8, published 15 January 2017.

**Which products and versions are affected?** WordPress WordPress < 4.7.1.

**Is there a fix for CVE-2017-5492?** A patch was published on 2017-01-11: WordPress version 4.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5492 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2017-5492?** Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in WordPress versions prior to 4.7.1 within the widget-editing accessibility-mode feature. The flaw is rooted in the lack of proper nonce (security token) validation in 'wp-admin/includes/class-wp-screen.php' and 'wp-admin/widgets.php'. A remote attacker can exploit this by inducing an authenticated user (typically an administrator) to visit a malicious URL or web page. Successful exploitation allows the attacker to perform 'widgets-access' actions on behalf of the victim, potentially leading to unauthorized modification of site widgets. The issue was addressed in version 4.7.1 by implementing mandatory nonce checks for these actions.

## Affected products

- WordPress WordPress < 4.7.1

## Timeline

- 2017-01-11: patched: WordPress version 4.7.1 released
- 2017-01-14: disclosed: Public disclosure via oss-security mailing list
- 2017-01-15: advisory: NVD publication date

## References

- [http://www.debian.org/security/2017/dsa-3779](http://www.debian.org/security/2017/dsa-3779)
- [http://www.openwall.com/lists/oss-security/2017/01/14/6](http://www.openwall.com/lists/oss-security/2017/01/14/6)
- [http://www.securityfocus.com/bid/95407](http://www.securityfocus.com/bid/95407)
- [http://www.securitytracker.com/id/1037591](http://www.securitytracker.com/id/1037591)
- [https://codex.wordpress.org/Version_4.7.1](https://codex.wordpress.org/Version_4.7.1)
- [https://github.com/WordPress/WordPress/commit/03e5c0314aeffe6b27f4b98fef842bf0fb00c733](https://github.com/WordPress/WordPress/commit/03e5c0314aeffe6b27f4b98fef842bf0fb00c733)
- [https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/](https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/)

## Related threats

- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)
- [WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt)
- [WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling)