Cross-site request forgery in WordPress - CVE-2017-5489
Published: January 17, 2017 / Updated: January 17, 2017
Vulnerability identifier: #VU4858
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5489
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform CSRF attacks.
The vulnerability exists due to improper validation of the HTTP request origin. A remote attacker can create a specially specially crafted web page, trick the authenticated victim into visiting it, perform cross-site request forgery attack and hijack authentication of unspecified victims.
Successful exploitation of the vulnerability may allow an attacker to hijack authentication.
Affected software
WordPress
Arch Linux
Arch Linux
How to mitigate CVE-2017-5489
Update to version 4.7.1