Security readout for executives and security teams
Plain-English summary
This CVE reports cross-site request forgery in the fossura-tag-miner WordPress plugin before version 1.1.5. In practical terms, a logged-in site administrator could potentially be tricked into causing an unintended plugin action. The public bundle does not describe the exact action, business impact, or affected installations.
Executive priority
Handle through normal vulnerability management unless the plugin is installed on high-value WordPress sites. Urgency rises if administrators use those sites frequently and the plugin version is below 1.1.5.
Technical view
CVE-2016-10978 is described only as CSRF in fossura-tag-miner before 1.1.5 for WordPress. No CVSS, CWE, vulnerable endpoint, required privilege, or impact detail is provided in the supplied CVE data. Treat exposure as plugin-version dependent until validated in the WordPress inventory.
Likely exposure
Likely limited to WordPress sites running fossura-tag-miner versions earlier than 1.1.5. The source bundle lacks CPEs and normalized vendor/product fields, so exposure should be confirmed through WordPress plugin inventory rather than asset-scanner naming alone.
Exploitation context
The bundle does not cite active exploitation, and the CVE is not listed as KEV. The available description supports only the presence of a CSRF issue, not exploit prevalence, exploit reliability, or the exact impact of a successful attack.
Researcher notes
Evidence is sparse. The CVE identifies CSRF and a version boundary but does not provide endpoint details, impact scope, authentication context, or proof-of-concept status. Avoid assuming severity beyond what plugin inventory and local testing confirm.
Mitigation direction
- Inventory WordPress sites for fossura-tag-miner installations.
- Update fossura-tag-miner to version 1.1.5 or later if available.
- Check the WordPress plugin page and vendor guidance for current remediation notes.
- Prioritize removal or replacement if the plugin is unused or unsupported.
Validation and detection
- Confirm whether fossura-tag-miner is installed on any WordPress instance.
- Record installed plugin versions and compare them with 1.1.5.
- Review administrator-facing plugin actions for CSRF protections during internal assessment.
- Verify remediation by rechecking plugin version after update or removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2016-10978 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpvulndb.com/vulnerabilities/8486CVE reference · x_refsource_MISC
- https://wordpress.org/plugins/fossura-tag-miner/#developersCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.