Description
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
Remediation
References
Related Vulnerabilities
Nginx Integer Overflow or Wraparound Vulnerability (CVE-2017-7529)
Django DEPRECATED: Code Vulnerability (CVE-2015-0219)
Drupal Incorrect Authorization Vulnerability (CVE-2020-13676)
WordPress Plugin Custom 404 Pro Unspecified Vulnerability (3.7.0)
WordPress Plugin YITH WooCommerce Quick View Security Bypass (1.3.13)