CVE-2018-10101 (MEDIUM 6.1) · Watchpost

← All vulnerabilities

CVE-2018-10101

MEDIUM 6.1CVE-2018-10101 · Published 16/04/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
wordpress wordpress	`< 4.9.5`	`4.9.5`

Description

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

References

securityfocus.com/bid/104350 · Third Party Advisory
securitytracker.com/id/1040836 · Third Party Advisory
codex.wordpress.org/Version_4.9.5 · Vendor Advisory
core.trac.wordpress.org/changeset/42894 · Patch
WordPress/WordPress commit 8043638 · Patch
wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release · Vendor Advisory
wpvulndb.com/vulnerabilities/9053 · Third Party Advisory
debian.org/security/2018/dsa-4193 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free