CVE-2016-6635

HIGH

WordPress < 4.4.2 - Cross-Site Request Forgery via wp_ajax_wp_compression_test

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://wpvulndb.com/vulnerabilities/8475
Release Notes x_refsource_confirm
http://codex.wordpress.org/Version_4.5
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3681

Scores

CVSS v3 8.8
EPSS 0.0029
EPSS Percentile 52.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
wordpress/wordpress < 4.4.2
Published Aug 07, 2016
Tracked Since Feb 18, 2026