CVE-2016-7169

Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.

CVSS v3.0

6.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

3.24% chance of exploitation in the next 30 days, 87th percentile

Nuclei

low

Published

2017-01-05

Updated

2024-08-06

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2016/CVE-2016-7169-wordpress-0f…

References

• CVE Record
• NVD entry

Related

• CVE-2016-7168
• CVE-2016-7182
• CVE-2016-7163
• CVE-2016-7185
• CVE-2016-7148
• CVE-2016-7188