CVE-2016-5839
HighSummary
WordPress versions before 4.5.3 allow remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
Risk Assessment
Bypassing this mechanism may lead to the introduction of malicious files on the server, posing a serious security threat to the site.
Recommendation
It is recommended to update WordPress to version 4.5.3 or later to mitigate this vulnerability.
Other vulnerabilities in WordPress
See all- CVE-2012-6707High
WordPress through version 4.8.2 uses a weak MD5-based password hashing algorithm, making it easier for attackers to determine cleartext values by leveraging access to the hash values.
- CVE-2017-9066High
In WordPress before version 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF vulnerability.
- CVE-2017-9065High
In WordPress before version 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
- CVE-2017-9064High
In WordPress before version 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.
- CVE-2017-9062High
In WordPress before version 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
- CVE-2016-6896High
A directory traversal vulnerability in the wp_ajax_update_plugin function in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php.
- CVE-2017-5489High
The CSRF vulnerability in WordPress before version 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving Flash file uploads.
- CVE-2016-4029High
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
- CVE-2016-5838High
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
- CVE-2016-5837High
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
Original NVD description (English source)
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.