{"id":"CVE-2017-5493","aliases":["DEBIAN-CVE-2017-5493","DLA-813-1","DSA-3779-1","EUVD-2017-14597","GHSA-q3gc-45gm-v55m","UBUNTU-CVE-2017-5493"],"status":"published","title":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not...","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02886,"percentile":0.86968,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-338"],"published":"2017-01-15T02:00:00Z","modified":"2026-10-24T10:49:35Z","fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["4.7.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["4.7.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["4.7.1+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb7u13"}]}],"versions":["3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5","3.6.1+dfsg-1~deb6u6","3.6.1+dfsg-1~deb6u7","3.6.1+dfsg-1~deb6u8","3.6.1+dfsg-1~deb6u9","3.6.1+dfsg-1~deb7u1","3.6.1+dfsg-1~deb7u10","3.6.1+dfsg-1~deb7u11","3.6.1+dfsg-1~deb7u12","3.6.1+dfsg-1~deb7u2","3.6.1+dfsg-1~deb7u3","3.6.1+dfsg-1~deb7u4","3.6.1+dfsg-1~deb7u5","3.6.1+dfsg-1~deb7u6","3.6.1+dfsg-1~deb7u8","3.6.1+dfsg-1~deb7u9"],"bundled":9},{"source":"osv","ecosystem":"Debian:8","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1+dfsg-1+deb8u12"}]}],"versions":["4.1+dfsg-1","4.1+dfsg-1+deb8u1","4.1+dfsg-1+deb8u10","4.1+dfsg-1+deb8u11","4.1+dfsg-1+deb8u2","4.1+dfsg-1+deb8u3","4.1+dfsg-1+deb8u4","4.1+dfsg-1+deb8u5","4.1+dfsg-1+deb8u6","4.1+dfsg-1+deb8u7","4.1+dfsg-1+deb8u8","4.1+dfsg-1+deb8u9"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]}],"products":[{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"https://wpvulndb.com/vulnerabilities/8721","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"http://www.securityfocus.com/bid/95401","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.debian.org/security/2017/dsa-3779","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://codex.wordpress.org/Version_4.7.1","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/14/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"http://www.securitytracker.com/id/1037591","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5493"},{"url":"https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release"},{"url":"https://github.com/advisories/GHSA-q3gc-45gm-v55m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5493","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-5493","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/14/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5493","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5493","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","status":"published","published":"2017-01-15T02:00:00Z","modified":"2024-08-05T15:04:14.697Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14597","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","status":"published","published":"2017-01-15T02:00:00Z","modified":"2024-08-05T15:04:14Z","updated_at":"2026-11-03T02:39:15.385305Z"}],"ghsa":[{"id":"GHSA-q3gc-45gm-v55m","title":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not...","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","status":"published","published":"2022-05-13T01:46:10Z","modified":"2025-04-20T03:32:17Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:01:39.626411Z"}],"nvd":[{"id":"CVE-2017-5493","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","status":"published","published":"2017-01-15T02:59:03.077Z","modified":"2026-06-17T01:20:36.63Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:03:42.372487Z"}],"osv":[{"id":"CVE-2017-5493","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","status":"published","published":"2017-01-15T02:59:03.077Z","modified":"2026-10-24T10:49:35.447329377Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5493","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","status":"published","published":"2017-01-15T02:59:03.077Z","modified":"2026-09-01T20:03:48.439631617Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-5493","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","status":"published","published":"2017-01-15T02:59:00Z","modified":"2025-10-24T04:46:09Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"DLA-813-1","title":"wordpress - security update","status":"published","published":"2017-02-01T00:00:00Z","modified":"2026-03-09T02:09:37.812645Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3779-1","title":"wordpress - security update","status":"published","published":"2017-02-01T00:00:00Z","modified":"2026-03-09T01:20:22.548557Z","updated_at":"2026-11-02T15:46:16.523846Z"}]}}