Description

wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.

Remediation

References

CVE-2017-5491

Related Vulnerabilities

WordPress Plugin AVK-Shop Multiple Cross-Site Scripting Vulnerabilities (1.1.1)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23214)

WordPress Plugin MyLiveChat-Free Live Chat Plugin for WordPress Cross-Site Scripting (2.0.1)

Atlassian Jira Incorrect Authorization Vulnerability (CVE-2020-36287)

WordPress Ultimate Member Plugin CVE-2025-0318 Vulnerability (CVE-2025-0318)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-1188 CVE-2017-5491