CVE-2016-5835

Published: Jun 29, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.

Affected (1)

Products: Wordpress: Wordpress

Wordpress

1 product

Wordpress

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	Up to 4.5.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (14)

http://www.debian.org/security/2016/dsa-3639

Source: security@debian.org

http://www.securityfocus.com/bid/91366

Source: security@debian.org

http://www.securitytracker.com/id/1036163

Source: security@debian.org

Third Party Advisory

https://codex.wordpress.org/Version_4.5.3

Source: security@debian.org

Release Notes

https://github.com/WordPress/WordPress/commit/a2904cc3092c391ac7027bc87f7806953d1a25a1

Source: security@debian.org

https://wordpress.org/news/2016/06/wordpress-4-5-3/

Source: security@debian.org

PatchVendor Advisory

https://wpvulndb.com/vulnerabilities/8519

Source: security@debian.org

http://www.debian.org/security/2016/dsa-3639