Description

Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.

Remediation

References

CVE-2016-2221

Related Vulnerabilities

Python URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2016-1000110)

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33327)

phpMyFAQ Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-6046)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-1381)

TYPO3 URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2010-3661)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CVE-2016-2221