WordPress Vulnerabilities

WordPress <= 5.2.3 - Admin Referrer Validation

Description

The fix changes the PHP equal identifier == to the identical identifier ===.

Affects WordPress

3.8.1

Fixed in version 3.8.31

3.8

Fixed in version 3.8.31

3.7.1

Fixed in version 3.7.31

3.9

Fixed in version 3.9.29

3.9.1

Fixed in version 3.9.29

3.7

Fixed in version 3.7.31

3.8.2

Fixed in version 3.8.31

3.8.3

Fixed in version 3.8.31

3.9.2

Fixed in version 3.9.29

4.0

Fixed in version 4.0.28

References

CVE

CVE-2019-17675

URL

https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/

URL

https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0

URL

https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CWE-352

Miscellaneous

Original Researcher

Ben Bidner (WordPress Security Team)

Verified

WPVDB ID

715c00e3-5302-44ad-b914-131c162c3f71

Timeline

Publicly Published

2019-10-14 (about 3 years ago)

Added

2019-10-15 (about 3 years ago)

Last Updated

2020-09-22 (about 2 years ago)

Our Other Services

WPScan WordPress Security Plugin