CVE-2017-6819

In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.

CVSS v3.0

6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

2.17% chance of exploitation in the next 30 days, 81th percentile

Nuclei

high

Published

2017-03-12

Updated

2024-08-05

Proof-of-concept exploits (2)

• http://openwall.com/lists/oss-security/2017/03/06/7
• https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_press_this_func…

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2017/CVE-2017-6819-wordpress-57…

References

• CVE Record
• NVD entry

Related

• CVE-2017-6818
• CVE-2017-6823
• CVE-2017-6817
• CVE-2017-6831
• CVE-2017-6816
• CVE-2017-6878