The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade wordpress | Feb 9, 2016 | Feb 8, 2016 |
| Freebsd | — | Upgrade ru-wordpressUpgrade zh-wordpress-zh_TWUpgrade zh-wordpress-zh_CNUpgrade ja-wordpressUpgrade de-wordpressUpgrade wordpress | Dec 10, 2025 | Mar 8, 2016 |
| Wordpress | — | Upgrade Wordpress to version 4.4.2 | May 16, 2017 | May 21, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub