CVE-2017-5493

HIGH 7.5CVE-2017-5493 · Published 15/01/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
wordpress wordpress	`≤ 4.7`	No fix yet

Description

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

References

debian.org/security/2017/dsa-3779
openwall.com/lists/oss-security/2017/01/14/6 · Mailing List
securityfocus.com/bid/95401
securitytracker.com/id/1037591
codex.wordpress.org/Version_4.7.1 · Release Notes
WordPress/WordPress commit cea9e2d · Patch
wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release · Vendor Advisory
wpvulndb.com/vulnerabilities/8721

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free