Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.

Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, cross-site request forgery, path traversal, or bypass restrictions.

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2015-8834: Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440

CVE-2016-4029: WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

CVE-2016-5836: The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.

CVE-2016-6634: Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2016-6635: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax- actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

CVE-2016-7168: Fix a cross-site scripting vulnerability via image filename.

CVE-2016-7169: Fix a path traversal vulnerability in the upgrade package uploader.

For Debian 7 'Wheezy', these problems have been fixed in version 3.6.1+dfsg-1~deb7u12.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.6.1.
It is, therefore, affected by multiple vulnerabilities :

  - A cross-site scripting vulnerability (XSS) exists when     handling file names of uploaded images due to improper     validation of input before returning it to users. An     authenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2016-7168)

  - A path traversal vulnerability exists in the WordPress     upgrade package uploader due to improper sanitization of     user-supplied input. An authenticated, remote attacker     can exploit this, via a specially crafted request, to     impact confidentiality, integrity, and availability.
    (CVE-2016-7169)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
93835	Debian DSA-3681-1 : wordpress - security update	Nessus	Debian Local Security Checks	high
93667	Debian DLA-633-1 : wordpress security update	Nessus	Debian Local Security Checks	high
93516	WordPress < 4.6.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2016-7169

medium

Tenable Plugins

high

high

medium