VULNERABILITY INTELLIGENCE

CVE-2017-5493

CVSS score7.5 HIGH
EPSS probability2.89%
CISA KEVNot currently listed
Published2017-01-15
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

Weakness classification

  • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Primary references