Test ID:	1.3.6.1.4.1.25623.1.0.108068
Category:	Web application abuses
Title:	WordPress < 4.7.2 Multiple Security Vulnerabilities - Linux
Summary:	WordPress is prone to multiple security vulnerabilities because it fails to sanitize user-supplied input.
Description:	Summary: WordPress is prone to multiple security vulnerabilities because it fails to sanitize user-supplied input. Vulnerability Insight: Multiple flaws are due to: - The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it. - P_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but hardening was added to prevent plugins and themes from accidentally causing a vulnerability. - A cross-site scripting (XSS) vulnerability was discovered in the posts list table. - An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint. Vulnerability Impact: Successfully exploiting this issue allow remote attacker to e.g. obtain sensitive information or inject arbitrary web script or HTML. Affected Software/OS: WordPress versions 4.7.1 and earlier. Solution: Update to WordPress version 4.7.2. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-5610 BugTraq ID: 95816 http://www.securityfocus.com/bid/95816 Debian Security Information: DSA-3779 (Google Search) http://www.debian.org/security/2017/dsa-3779 https://wpvulndb.com/vulnerabilities/8729 http://www.openwall.com/lists/oss-security/2017/01/28/5 http://www.securitytracker.com/id/1037731 Common Vulnerability Exposure (CVE) ID: CVE-2017-5611 https://codex.wordpress.org/Version_4.7.2 https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ https://wpvulndb.com/vulnerabilities/8730 https://www.oracle.com/security-alerts/cpujan2021.html Common Vulnerability Exposure (CVE) ID: CVE-2017-5612 https://wpvulndb.com/vulnerabilities/8731 Common Vulnerability Exposure (CVE) ID: CVE-2017-1001000 https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab http://www.openwall.com/lists/oss-security/2017/02/10/16
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.