Main Vulnerability Database Vulnerabilities #VU12401

Security restrictions bypass in WordPress - CVE-2018-10101

Published: May 8, 2018

Vulnerability identifier: #VU12401

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10101

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. A remote attacker can bypass security restrictions.

Affected software

WordPress
Debian Linux

How to mitigate CVE-2018-10101

Update to version 4.9.5.

External References

https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/

Related Security Bulletins