CVE-2016-6896

The exploit demonstrates a path traversal vulnerability in WordPress Core Ajax handlers, specifically in the wp_ajax_update_plugin() function. It allows an authenticated user (Subscriber) to trigger a denial of service (DoS) by exhausting the entropy pool via repeated reads from /dev/random.

This Metasploit module exploits a CSRF vulnerability in WordPress before 4.6 to perform a directory traversal DoS attack by sending multiple requests to read /dev/random, causing service disruption.