CVE-2016-2222

HIGH

WordPress < 4.4.2 - Server-Side Request Forgery via IPv4 Address in u Parameter

Title source: manual
STIX 2.1

Description

The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.

References (9)

Core 9
Core References
Patch x_refsource_confirm
https://codex.wordpress.org/Version_4.4.2
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034933
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/8376
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/82454
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3472
Exploit x_refsource_misc
https://hackerone.com/reports/110801
Various Sources x_refsource_misc
https://news.ycombinator.com/item?id=20433070

Scores

CVSS v3 8.6
EPSS 0.0517
EPSS Percentile 90.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Details

Status published
Products (1)
wordpress/wordpress 4.4.1
Published May 22, 2016
Tracked Since Feb 18, 2026