Description
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
Remediation
References
Related Vulnerabilities
WordPress Plugin Highlight Cross-Site Scripting (0.9.2)
WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.24)
WordPress Plugin Companion Revision Manager-Revision Control Unspecified Vulnerability (1.3)
MySQL CVE-2014-2434 Vulnerability (CVE-2014-2434)
MyBB URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-20225)