Unrated
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
CVE-2018-10101
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2018-10101 wordpress Fixed in: 4.9.5+dfsg1-1
References
- advisory securityfocus.com
- advisory securitytracker.com
- advisory codex.wordpress.org
- advisory wordpress.org
- advisory wpvulndb.com
- advisory debian.org
- patch core.trac.wordpress.org
- patch github.com