CVE-2016-6635

Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp...

8.8 HighFix available

Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.91%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

Record: CVE-2016-6635
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-6635
Updated: 2026-11-02

EUVDEUVD-2016-7540 No score

Record: EUVD-2016-7540
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g94h-w5p9-mvxc 8.8

Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp...

Record: GHSA-g94h-w5p9-mvxc
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

OSV 8.8

Record: CVE-2016-6635
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-6635 8.8

Record: DEBIAN-CVE-2016-6635
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-6635 8.8

Record: UBUNTU-CVE-2016-6635
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

wordpress

Affected packages

Affected packages
Package	Affected	Fixed
`wordpress` Debian:12	before 4.5+dfsg-1	4.5+dfsg-1
`wordpress` Debian:13	before 4.5+dfsg-1	4.5+dfsg-1
`wordpress` Debian:14	before 4.5+dfsg-1	4.5+dfsg-1
`wordpress` Debian:7 From an advisory covering 7 CVEs	before 3.6.1+dfsg-1~deb7u12, plus listed versions 3.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-1 Show 19 moreShow less 3.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u53.6.1+dfsg-1~deb6u63.6.1+dfsg-1~deb6u73.6.1+dfsg-1~deb6u83.6.1+dfsg-1~deb6u93.6.1+dfsg-1~deb7u13.6.1+dfsg-1~deb7u103.6.1+dfsg-1~deb7u113.6.1+dfsg-1~deb7u23.6.1+dfsg-1~deb7u33.6.1+dfsg-1~deb7u43.6.1+dfsg-1~deb7u53.6.1+dfsg-1~deb7u63.6.1+dfsg-1~deb7u83.6.1+dfsg-1~deb7u9	3.6.1+dfsg-1~deb7u12
`wordpress` Debian:8 From an advisory covering 5 CVEs	before 4.1+dfsg-1+deb8u10, plus listed versions 4.1+dfsg-14.1+dfsg-1+deb8u14.1+dfsg-1+deb8u24.1+dfsg-1+deb8u34.1+dfsg-1+deb8u4 Show 5 moreShow less 4.1+dfsg-1+deb8u54.1+dfsg-1+deb8u64.1+dfsg-1+deb8u74.1+dfsg-1+deb8u84.1+dfsg-1+deb8u9	4.1+dfsg-1+deb8u10
`wordpress` Ubuntu:16.04:LTS	All versions, plus listed versions 4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-6635 is a high vulnerability (CVSS 8.8) in Wordpress, published August 7, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in wordpress 4.5+dfsg-1.