Description
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Remediation
References
Related Vulnerabilities
Joomla Use of Insufficiently Random Values Vulnerability (CVE-2012-1562)
MySQL CVE-2022-21316 Vulnerability (CVE-2022-21316)
WordPress Plugin Affiliates Manager Unspecified Vulnerability (2.7.7)
SharePoint Other Vulnerability (CVE-2020-1147)
WordPress Plugin Page Builder by SiteOrigin Cross-Site Scripting (2.0.4)