CVE-2018-10100 (MEDIUM 6.1) · Watchpost

← All vulnerabilities

CVE-2018-10100

MEDIUM 6.1CVE-2018-10100 · Published 16/04/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
wordpress wordpress	`< 4.9.5`	`4.9.5`

Description

Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.

References

securitytracker.com/id/1040836 · Third Party Advisory
codex.wordpress.org/Version_4.9.5 · Vendor Advisory
core.trac.wordpress.org/changeset/42892 · Vendor Advisory
WordPress/WordPress commit 14bc2c0 · Patch
lists.debian.org/debian-lts-announce/2018/04/msg00031.html · Third Party Advisory
wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release · Third Party Advisory
wpvulndb.com/vulnerabilities/9054 · Third Party Advisory
debian.org/security/2018/dsa-4193 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free