2 matches found
CVE-2016-10148
The wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a getplugindata call before checking the updateplugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to...
4.3CVSS5.2AI score0.01641EPSS
SaveExploits0References5
CVE-2016-10148
The wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a getplugindata call before checking the updateplugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to...
4.3CVSS5.1AI score0.01641EPSS
SaveExploits0
20