WordPress Vulnerabilities

WordPress <= 5.2.3 - Server-Side Request Forgery (SSRF) in URL Validation

Affects WordPress

3.8.1

Fixed in version 3.8.31

3.8

Fixed in version 3.8.31

3.7.1

Fixed in version 3.7.31

3.9

Fixed in version 3.9.29

3.9.1

Fixed in version 3.9.29

3.7

Fixed in version 3.7.31

3.8.2

Fixed in version 3.8.31

3.8.3

Fixed in version 3.8.31

3.9.2

Fixed in version 3.9.29

4.0

Fixed in version 4.0.28

References

CVE

CVE-2019-17669

CVE

CVE-2019-17670

URL

https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/

URL

https://github.com/WordPress/WordPress/commit/9db44754b9e4044690a6c32fd74b9d5fe26b07b2

URL

https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html

Classification

Type

SSRF

OWASP top 10

A1: Injection

CWE

CWE-918

Miscellaneous

Original Researcher

Eugene Kolodenker

Verified

WPVDB ID

26a26de2-d598-405d-b00c-61f71cfacff6

Timeline

Publicly Published

2019-10-14 (about 3 years ago)

Added

2019-10-15 (about 3 years ago)

Last Updated

2020-09-22 (about 2 years ago)

Our Other Services

WPScan WordPress Security Plugin