漏洞编号：CVE-2016-4029 WordPress Prior to 4.5 Multiple Security Vulnerabilities

WordPress is an open source blogging tool and content management system based on PHP and MySQL. It has many features including a plug-in architecture and a template system.

WordPress versions prior to 4.5 contain the following vulnerabilities:
CVE-2016-4029: WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
CVE-2016-6634: Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-6635: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

Affected Versions:
WordPress prior to 4.5

QID Detection Logic:
This QID depends on BlindElephant engine to detect the version of the WordPress installation as active attacks could potentially harm live installations.

Depending on the vulnerability being exploited, a remote attacker could cross-site scripting attacks, cross-site request forgery attacks or bypass security restrictions on the targeted system.

Customers are advised to install WordPress 4.5 or later versions to remediate the vulnerabilities.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

WordPress 4.5 or later