Description

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.

Remediation

References

CVE-2019-17675

Related Vulnerabilities

WordPress Plugin HTML5 Video Player-Best WordPress Video Player and Block SQL Injection (2.5.26)

Jboss EAP Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-28367)

Envoy Proxy Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-15225)

WordPress Plugin VideoWhisper Video Conference Integration Arbitrary File Upload (4.91.8)

WordPress Plugin CYSTEME Finder, the admin files explorer Cross-Site Request Forgery (1.4)

Severity

High

Classification

CVE-2019-17675 CWE-843 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities