CVE-2016-10148

The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6...

4.3 MediumFix available

CVE-2016-10148 is a medium vulnerability (CVSS 4.3) in Wordpress, published January 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. Fixed in wordpress 4.6.1+dfsg-1.

The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

1.64%Up 0.5 points since Mar 1, 2023

What each source reports

NVD Score used 4.3

Record: CVE-2016-10148
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-254, CWE-284
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-10148
Updated: 2026-11-02

EUVDEUVD-2016-1337 No score

Record: EUVD-2016-1337
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3wwg-h2fr-3v7w 4.3

The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6...

Record: GHSA-3wwg-h2fr-3v7w
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSV 4.3

Record: CVE-2016-10148
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-10148 4.3

Record: DEBIAN-CVE-2016-10148
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-10148 4.3

Record: UBUNTU-CVE-2016-10148
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Affected products

wordpress

Affected packages

Affected packages
Package	Affected	Fixed
`wordpress` Debian:12	before 4.6.1+dfsg-1	4.6.1+dfsg-1
`wordpress` Debian:13	before 4.6.1+dfsg-1	4.6.1+dfsg-1
`wordpress` Debian:14	before 4.6.1+dfsg-1	4.6.1+dfsg-1
`wordpress` Ubuntu:16.04:LTS	All versions, plus listed versions 4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less