# CVE-2017-5493: WordPress Multisite weak random number generation in activation keys

Source: https://junglewise.ai/threats/cve-2017-5493-wordpress-multisite-weak-random-number-generation-in-activation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-15. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5493 · Severity: high · CVSS 7.5 · Published 2017-01-15

A security weakness in WordPress Multisite could allow unauthorized users to bypass registration restrictions. The system used predictable random numbers when generating activation keys for new sites or user accounts. This could allow an attacker to guess these keys and activate accounts or sites without proper authorization, potentially leading to unauthorized access or site creation.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2017-5493 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5493 being exploited in the wild.

**How severe is CVE-2017-5493?** High severity, with a CVSS score of 7.5, published 15 January 2017.

**Which products and versions are affected?** WordPress WordPress < 4.7.1.

**Is there a fix for CVE-2017-5493?** A patch was published on 2017-01-11: WordPress version 4.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5493 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2017-5493?** Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in `wp-includes/ms-functions.php` within the WordPress Multisite API. The software utilized a cryptographically weak pseudo-random number generator (PRNG) to generate activation keys for new user and site signups. Because the generated keys were predictable, a remote attacker could potentially guess a valid key. This allows for the bypass of intended access restrictions, enabling the unauthorized activation of accounts or sites. The issue was addressed in version 4.7.1 by migrating to the more secure `wp_rand()` function for key creation.

## Affected products

- WordPress WordPress < 4.7.1

## Timeline

- 2017-01-11: patched: WordPress version 4.7.1 released
- 2017-01-14: disclosed: Public disclosure via oss-security mailing list
- 2017-01-15: advisory: NVD publication date

## References

- [http://www.debian.org/security/2017/dsa-3779](http://www.debian.org/security/2017/dsa-3779)
- [http://www.openwall.com/lists/oss-security/2017/01/14/6](http://www.openwall.com/lists/oss-security/2017/01/14/6)
- [http://www.securityfocus.com/bid/95401](http://www.securityfocus.com/bid/95401)
- [http://www.securitytracker.com/id/1037591](http://www.securitytracker.com/id/1037591)
- [https://codex.wordpress.org/Version_4.7.1](https://codex.wordpress.org/Version_4.7.1)
- [https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4](https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4)
- [https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/](https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/)

## Related threats

- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)
- [WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt)
- [WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling)