Description

wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.

Remediation

References

CVE-2014-9038

Related Vulnerabilities

WordPress Plugin Mobile Apps by Wiziapp (Native iPhone & Android mobile Apps) Multiple Unspecified Vulnerabilities (4.1.2)

WordPress Plugin Advanced Dynamic Pricing for WooCommerce Multiple Vulnerabilities (4.1.5)

WordPress Plugin Slider Hero with Animation, Video Background Cross-Site Scripting (8.4.3)

Apache Tomcat Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2019-17569)

WordPress Plugin CrossSlide jQuery Multiple Vulnerabilities (2.0.5)

Severity

Medium

Classification

CVE-2014-9038 CWE-20

Tags

Missing Update Known Vulnerabilities