Improper input validation in WordPress - CVE-2017-6816

Vulnerability identifier: #VU5934

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-6816

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated administrator to delete certain files.

The vulnerability is caused by unknown error within plugin deletion functionality (wp-admin/plugins.php). A remote authenticated administrator can unintentionally delete certain files on the system.

WordPress
Arch Linux
wordpress (Debian package)

Update to version 4.7.3.

WordPress - update to 4.7.3
wordpress (Debian package) - update to 4.1+dfsg-1+deb8u13

• https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/

• Multiple vulnerabilities in WordPress
• Arch Linux update for wordpress
• Debian update for wordpress
• Improper input validation in WordPress WordPress