Vulnerabilitycritical

WordPress admins, take note: RCE and password reset vulnerabilities revealed

Help Net Securityby @zeljkazorzMay 27, 2020 · 08:55 UTC (May 27, 2020)2 min read3 · 1 read

Read at helpnetsecurity.com

Analyze CVE-2016-10033 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2016-10033 CVE-2017-8295

Tags: cve-2016-10033 cve-2017-8295 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2016-10033	Command Injection RCE in PHPMailer (Ships with WordPress and Joomla)	9.8	100%	KEVPoC ×14	Dec 30, 2016 KEV Jul 7, 2025
CVE-2017-8295	WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary…	5.9	27%	PoC ×2	May 4, 2017

From the original article

2 min read at helpnetsecurity.com

Independent security researcher Dawid Golunski has released a proof-of-concept exploit code for an unauthenticated remote code execution vulnerability in WordPress 4. 6 (CVE-2016-10033), and information about an unauthorized password reset zero-day vulnerability (CVE-2017-8295) in the latest version of the popular CMS.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.