Vulnerability
CVE-2016-10148
MEDIUM 4.3
CVE-2016-10148 is a medium-severity vulnerability (CVSS v3.0 4.3). As of 2026-11-04, 58 hosts in our data show software it affects on an open service in 11 countries.
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.
- Published
- 2017-01-18
- Last modified
- 2026-06-17
- CVSS score
- 4.3 CVSS v3.0
- CVSS vector (v3.0)
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Exploit likelihood (EPSS)
- 1.6% in the next 30 days (top 24% of CVEs)
Exposure in our data
58 hosts
Hosts whose banner shows an affected software version on a service open at their latest check.
Not counted: 31 hosts with this CVE only from an older observation.
Counted 2026-11-04 04:20 UTC
By country
| Sweden SE | 22 |
| Finland FI | 18 |
| Lithuania LT | 9 |
| Norway NO | 2 |
| Czechia CZ | 1 |
| Germany DE | 1 |
| Estonia EE | 1 |
| United Kingdom GB | 1 |
| Latvia LV | 1 |
| Russia RU | 1 |
| Singapore SG | 1 |
Affected software seen
| wordpress 2.8 | 12 |
| wordpress 4.3.33 | 6 |
| wordpress 3.6.1 | 3 |
| wordpress 3.9.40 | 3 |
| wordpress 3.8.1 | 2 |
| wordpress 4.1.42 | 2 |
| wordpress 4.3.1 | 2 |
| wordpress 4.4.1 | 2 |
| wordpress 4.4.10 | 2 |
| wordpress 4.4.33 | 2 |
| wordpress 4.4.4 | 2 |
| wordpress 3.0.5 | 1 |