CVE-2016-7169: WordPress

Medium severity, CVSS 6.3. EPSS: 3.2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.

Affected products

• WordPress WordPress: up to and including 4.6

Published 2017-01-05. Last modified 2026-06-17.