PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6896 Wordpress CVE debrief

CVE-2016-6896 is an authenticated directory traversal issue in WordPress’s wp_ajax_update_plugin handler. The flaw lets a remote user with the required login context supply traversal sequences in the plugin parameter to wp-admin/admin-ajax.php, which can lead to reading certain text files or triggering denial-of-service conditions. The supplied NVD record classifies the issue as CWE-22 and rates it CVSS 7.1 High.

Vendor
Wordpress
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

WordPress site owners, managed hosting providers, and security teams operating WordPress 4.5.3 or code paths that include the affected admin-ajax plugin update handler. Any environment that grants lower-privilege authenticated users access to WordPress admin AJAX functionality should review exposure.

Technical summary

The vulnerable function is wp_ajax_update_plugin in wp-admin/includes/ajax-actions.php. According to the supplied description and NVD record, authenticated remote users can abuse the plugin parameter with .. traversal patterns against wp-admin/admin-ajax.php. NVD’s vector is CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, indicating network reachability, low attack complexity, limited confidentiality impact, and high availability impact. The record also maps the issue to CWE-22 (Path Traversal).

Defensive priority

High. The issue is network-reachable, requires authentication rather than physical access, and can affect availability as well as limited file disclosure.

Recommended defensive actions

  • Upgrade WordPress to a release that includes a fix for this issue.
  • Audit who can reach WordPress admin AJAX endpoints and apply least privilege to authenticated roles.
  • Review logs for unusual wp-admin/admin-ajax.php requests containing traversal-like plugin parameters.
  • Monitor for file-read anomalies and resource exhaustion symptoms on affected hosts.
  • Confirm asset inventory against the supplied NVD CPE mapping for WordPress 4.5.3 and prioritize remediation where that version is present.

Evidence notes

The supplied NVD record lists WordPress 4.5.3 as the vulnerable CPE and assigns CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H with CWE-22. The corpus also includes an OSS Security mailing list reference dated 2016-08-20 and a third-party technical advisory describing the path traversal issue. The debrief avoids unverified claims beyond the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6896 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6896

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6896 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6896

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.