Description

WordPress is prone to multiple vulnerabilities, including server-side request forgery and open redirect vulnerabilities. Exploiting these issues could allow an attacker to make the vulnerable server perform port scanning of hosts in internal or external networks or to redirect users to arbitrary web sites and conduct phishing attacks; other attacks are also possible. WordPress versions ranging from 3.7 and up to (and including) 3.7.12 are vulnerable.

Remediation

Update to WordPress version 3.7.13 or latest

References

https://hackerone.com/reports/110801

https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/

http://www.openwall.com/lists/oss-security/2016/02/04/6

Related Vulnerabilities

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-6387)

ATutor Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-3368)

WordPress Plugin Aoi Tori Cross-Site Scripting (1.1)

Oracle Database Server CVE-2020-2737 Vulnerability (CVE-2020-2737)

OpenSSL Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2022-2097)

Severity

High

Classification

CVE-2016-2221 CVE-2016-2222 CWE-601 CWE-918 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update