cve/2017/CVE-2017-6819.md

CVE-2017-6819

Description

In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.

POC

Reference

• http://openwall.com/lists/oss-security/2017/03/06/7
• https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_press_this_function_allows_dos.html
• https://wpvulndb.com/vulnerabilities/8770

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Afetter618/WordPress-PenTest
• https://github.com/dayanaclaghorn/codepathWP
• https://github.com/nke5ka/codepathWeek7
• https://github.com/ryanfantus/codepath-week-7