CVE-2017-5493

high

Description

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

References

Advisories
More

http://www.openwall.com/lists/oss-security/2017/01/14/6

http://www.debian.org/security/2017/dsa-3779

https://wpvulndb.com/vulnerabilities/8721

https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/

https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4

https://codex.wordpress.org/Version_4.7.1

http://www.securitytracker.com/id/1037591

http://www.securityfocus.com/bid/95401

Details

Source: Mitre, NVD

Published: 2017-01-15

Updated: 2025-04-20

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Severity: High

EPSS

EPSS: 0.01668