PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5610 Debian CVE debrief

CVE-2017-5610 is a WordPress core information-disclosure issue in Press This. Before WordPress 4.7.2, the taxonomy-assignment user interface in wp-admin/includes/class-wp-press-this.php did not properly restrict visibility, allowing remote attackers to read terms they should not have been able to access. NVD rates the issue CVSS 5.3 (medium) with network access, no privileges, and no user interaction required. Upgrading to WordPress 4.7.2 or later resolves the issue, and Debian references the upstream fix in DSA-3779.

Vendor
Debian
Product
CVE-2017-5610
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

WordPress site operators running 4.7.1 or earlier, managed hosting providers, and Debian-based administrators tracking WordPress security updates. Security teams should also care if Press This remains enabled or if taxonomy data exposure matters in their environment.

Technical summary

The vulnerable code path is in wp-admin/includes/class-wp-press-this.php. In affected releases, Press This exposed a taxonomy-assignment interface without correctly enforcing visibility restrictions, which could let an unauthenticated remote attacker read taxonomy terms. The NVD entry maps the weakness to CWE-200 and lists WordPress versions through 4.7.1 as affected; it also includes Debian Linux 8.0 and 9.0 CPE criteria in its affected-platform mapping. The upstream fix is linked to the WordPress 4.7.2 security release and commit 21264a31e0849e6ff793a06a17de877dd88ea454.

Defensive priority

Medium. The impact is limited to information disclosure, but the attack requires no authentication or user interaction and is reachable over the network.

Recommended defensive actions

  • Upgrade WordPress to 4.7.2 or later.
  • If you rely on Debian-packaged WordPress, follow Debian security advisory DSA-3779 and apply the vendor update path used in your environment.
  • Verify that any Press This-related administrative interfaces are not exposed to unauthorized users after updating.
  • Use the WordPress 4.7.2 release notes and the upstream patch commit as remediation references when validating change control.

Evidence notes

All claims above are supported by the supplied NVD record and its referenced WordPress/Debian advisories. The source metadata identifies WordPress versions through 4.7.1 as vulnerable, cites CWE-200, and includes the WordPress 4.7.2 security release plus commit 21264a31e0849e6ff793a06a17de877dd88ea454 as patch references. Debian DSA-3779 is listed as a third-party advisory reference.

Official resources

Published by NVD on 2017-01-30. The supplied source record was last modified on 2026-05-13, but that is a record-update timestamp, not the vulnerability date. The remediation references point to the WordPress 4.7.2 security release and the