The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a     get_plugin_data call before checking the update_plugins capability, which allows remote authenticated     users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a     related issue to CVE-2016-6896. (CVE-2016-10148)

Note that Nessus relies on the presence of the package as reported by the vendor.

Versions of WordPress 4.5.x prior to 4.6 are affected by multiple vulnerabilities :

 - A path traversal vulnerability exists in the WordPress Admin API in the 'wp_ajax_update_plugin()' function in 'ajax-actions.php' due to improper sanitization of user-supplied input.  An authenticated, remote attacker can exploit this, via a specially crafted request, to cause a denial of service condition. (CVE-2016-6896)
 - A cross-site request forgery vulnerability (CSRF/XSRF) exists in the 'admin-ajax.php' script due to a failure to require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions.  An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to perform arbitrary AJAX updates. (CVE-2016-6897)
 - An information disclosure vulnerability exists in the 'wp_ajax_update_plugin()' function in the 'ajax-actions.php' script due to performing a call to 'get_plug_data()' before checking capabilities.  An authenticated, remote attacker can exploit this to bypass intended read-access restrictions, resulting in a disclosure of sensitive information. (CVE-2016-10148)

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.6. It is, therefore, affected by multiple vulnerabilities :

  - A path traversal vulnerability exists in the WordPress     Admin API in the wp_ajax_update_plugin() function in     ajax-actions.php due to improper sanitization of     user-supplied input. An authenticated, remote attacker     can exploit this, via a specially crafted request, to     cause a denial of service condition. (CVE-2016-6896)

  - A cross-site request forgery vulnerability (XSRF) exists     in the admin-ajax.php script due to a failure to require     multiple steps, explicit confirmation, or a unique token     when performing certain sensitive actions. An     unauthenticated, remote attacker can exploit this, by     convincing a user to follow a specially crafted link, to     perform arbitrary AJAX updates. (CVE-2016-6897)

  - An information disclosure vulnerability exists in the     wp_ajax_update_plugin() function in the ajax-actions.php     script due to performing a call to get_plug_data()     before checking capabilities. An authenticated, remote     attacker can exploit this to bypass intended read-access     restrictions, resulting in a disclosure of sensitive     information. (CVE-2016-10148)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
254744	Linux Distros Unpatched Vulnerability : CVE-2016-10148	Nessus	Misc.	Local	medium
9949	WordPress 4.5.x < 4.6 Multiple Vulnerabilities	Nessus Network Monitor	CGI		medium
93111	WordPress < 4.6 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2016-10148

medium

Tenable Plugins

medium

medium

high