CVE-2016-6635

Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

References

Affected packages

Git / github.com/wordpress/wordpress

Affected ranges

Type

GIT

Repo

https://github.com/wordpress/wordpress

Events

Introduced

Last Affected

e2ac39aa0e88d96336b67d40886bb02fc97cfbf5

Fixed

9b7a7754133c50b82bd9d976fb5b24094f658aab

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "4.4.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "9b7a7754133c50b82bd9d976fb5b24094f658aab"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

4.*

4.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6635.json"

Git / github.com/wordpress/wordpress-develop