WordPress CVEs

Description

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 4.7

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Up to and including 4.7

References

• www.debian.org http://www.debian.org/security/2017/dsa-3779
• www.openwall.com http://www.openwall.com/lists/oss-security/2017/01/14/6 Mailing List, Third Party Advisory
• www.securityfocus.com http://www.securityfocus.com/bid/95401
• www.securitytracker.com http://www.securitytracker.com/id/1037591
• codex.wordpress.org https://codex.wordpress.org/Version_4.7.1 Release Notes, Vendor Advisory
• github.com https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4 Patch
• wordpress.org https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Vendor Advisory
• wpvulndb.com https://wpvulndb.com/vulnerabilities/8721
• nvd.nist.gov Official NVD record