WordPress Vulnerabilities

WordPress 3.7-4.9.4 - Use Safe Redirect for Login

Description

Use safe redirects when redirecting the login page if SSL is forced.

Affects WordPress

3.8.1
Fixed in WordPress 3.8.26
3.8
Fixed in WordPress 3.8.26
3.7.1
Fixed in WordPress 3.7.26
3.9
Fixed in WordPress 3.9.24
3.9.1
Fixed in WordPress 3.9.24
3.7
Fixed in WordPress 3.7.26
3.8.2
Fixed in WordPress 3.8.26
3.8.3
Fixed in WordPress 3.8.26
3.9.2
Fixed in WordPress 3.9.24
4.0
Fixed in WordPress 4.0.23
4.1
Fixed in WordPress 4.1.23
4.1.1
Fixed in WordPress 4.1.23
4.2
Fixed in WordPress 4.2.20
3.9.3
Fixed in WordPress 3.9.24
4.1.2
Fixed in WordPress 4.1.23
4.2.1
Fixed in WordPress 4.2.20
4.0.1
Fixed in WordPress 4.0.23
4.1.5
Fixed in WordPress 4.1.23
4.1.4
Fixed in WordPress 4.1.23
4.1.3
Fixed in WordPress 4.1.23
3.8.4
Fixed in WordPress 3.8.26
3.7.4
Fixed in WordPress 3.7.26
4.2.3
Fixed in WordPress 4.2.20
3.8.8
Fixed in WordPress 3.8.26
3.8.5
Fixed in WordPress 3.8.26
3.8.6
Fixed in WordPress 3.8.26
3.8.7
Fixed in WordPress 3.8.26
3.7.2
Fixed in WordPress 3.7.26
3.7.3
Fixed in WordPress 3.7.26
3.7.5
Fixed in WordPress 3.7.26
3.7.6
Fixed in WordPress 3.7.26
3.7.7
Fixed in WordPress 3.7.26
3.7.8
Fixed in WordPress 3.7.26
3.7.9
Fixed in WordPress 3.7.26
3.8.9
Fixed in WordPress 3.8.26
3.9.4
Fixed in WordPress 3.9.24
3.9.5
Fixed in WordPress 3.9.24
3.9.6
Fixed in WordPress 3.9.24
3.9.7
Fixed in WordPress 3.9.24
4.0.2
Fixed in WordPress 4.0.23
4.0.3
Fixed in WordPress 4.0.23
4.0.4
Fixed in WordPress 4.0.23
4.0.5
Fixed in WordPress 4.0.23
4.0.6
Fixed in WordPress 4.0.23
4.1.6
Fixed in WordPress 4.1.23
4.2.2
Fixed in WordPress 4.2.20
4.2.4
Fixed in WordPress 4.2.20
4.1.7
Fixed in WordPress 4.1.23
4.0.7
Fixed in WordPress 4.0.23
3.9.8
Fixed in WordPress 3.9.24
3.8.10
Fixed in WordPress 3.8.26
3.7.10
Fixed in WordPress 3.7.26
4.3
Fixed in WordPress 4.3.16
4.3.1
Fixed in WordPress 4.3.16
4.2.5
Fixed in WordPress 4.2.20
4.1.8
Fixed in WordPress 4.1.23
4.0.8
Fixed in WordPress 4.0.23
3.9.9
Fixed in WordPress 3.9.24
3.8.11
Fixed in WordPress 3.8.26
3.7.11
Fixed in WordPress 3.7.26
4.4
Fixed in WordPress 4.4.15
3.7.12
Fixed in WordPress 3.7.26
3.8.12
Fixed in WordPress 3.8.26
3.9.10
Fixed in WordPress 3.9.24
4.0.9
Fixed in WordPress 4.0.23
4.1.9
Fixed in WordPress 4.1.23
4.2.6
Fixed in WordPress 4.2.20
4.3.2
Fixed in WordPress 4.3.16
4.4.1
Fixed in WordPress 4.4.15
4.4.2
Fixed in WordPress 4.4.15
4.3.3
Fixed in WordPress 4.3.16
4.2.7
Fixed in WordPress 4.2.20
4.1.10
Fixed in WordPress 4.1.23
4.0.10
Fixed in WordPress 4.0.23
3.9.11
Fixed in WordPress 3.9.24
3.8.13
Fixed in WordPress 3.8.26
3.7.13
Fixed in WordPress 3.7.26
4.5
Fixed in WordPress 4.5.14
4.5.1
Fixed in WordPress 4.5.14
3.7.14
Fixed in WordPress 3.7.26
3.8.14
Fixed in WordPress 3.8.26
3.9.12
Fixed in WordPress 3.9.24
4.0.11
Fixed in WordPress 4.0.23
4.1.11
Fixed in WordPress 4.1.23
4.2.8
Fixed in WordPress 4.2.20
4.3.4
Fixed in WordPress 4.3.16
4.4.3
Fixed in WordPress 4.4.15
4.5.2
Fixed in WordPress 4.5.14
4.5.3
Fixed in WordPress 4.5.14
3.7.15
Fixed in WordPress 3.7.26
3.8.15
Fixed in WordPress 3.8.26
3.9.13
Fixed in WordPress 3.9.24
4.0.12
Fixed in WordPress 4.0.23
4.1.12
Fixed in WordPress 4.1.23
4.2.9
Fixed in WordPress 4.2.20
4.3.5
Fixed in WordPress 4.3.16
4.4.4
Fixed in WordPress 4.4.15
4.6
Fixed in WordPress 4.6.11
3.7.16
Fixed in WordPress 3.7.26
3.8.16
Fixed in WordPress 3.8.26
3.9.14
Fixed in WordPress 3.9.24
4.0.13
Fixed in WordPress 4.0.23
4.1.13
Fixed in WordPress 4.1.23
4.2.10
Fixed in WordPress 4.2.20
4.3.6
Fixed in WordPress 4.3.16
4.4.5
Fixed in WordPress 4.4.15
4.5.4
Fixed in WordPress 4.5.14
4.6.1
Fixed in WordPress 4.6.11
4.7
Fixed in WordPress 4.7.10
3.7.17
Fixed in WordPress 3.7.26
3.8.17
Fixed in WordPress 3.8.26
3.9.15
Fixed in WordPress 3.9.24
4.0.14
Fixed in WordPress 4.0.23
4.1.14
Fixed in WordPress 4.1.23
4.2.11
Fixed in WordPress 4.2.20
4.3.7
Fixed in WordPress 4.3.16
4.4.6
Fixed in WordPress 4.4.15
4.5.5
Fixed in WordPress 4.5.14
4.7.1
Fixed in WordPress 4.7.10
4.6.2
Fixed in WordPress 4.6.11
3.7.18
Fixed in WordPress 3.7.26
3.8.18
Fixed in WordPress 3.8.26
3.9.16
Fixed in WordPress 3.9.24
4.0.15
Fixed in WordPress 4.0.23
4.1.15
Fixed in WordPress 4.1.23
4.2.12
Fixed in WordPress 4.2.20
4.3.8
Fixed in WordPress 4.3.16
4.4.7
Fixed in WordPress 4.4.15
4.5.6
Fixed in WordPress 4.5.14
4.6.3
Fixed in WordPress 4.6.11
4.7.2
Fixed in WordPress 4.7.10
3.7.19
Fixed in WordPress 3.7.26
3.8.19
Fixed in WordPress 3.8.26
3.9.17
Fixed in WordPress 3.9.24
4.0.16
Fixed in WordPress 4.0.23
4.1.16
Fixed in WordPress 4.1.23
4.2.13
Fixed in WordPress 4.2.20
4.3.9
Fixed in WordPress 4.3.16
4.4.8
Fixed in WordPress 4.4.15
4.5.7
Fixed in WordPress 4.5.14
4.6.4
Fixed in WordPress 4.6.11
4.7.3
Fixed in WordPress 4.7.10
3.7.20
Fixed in WordPress 3.7.26
3.8.20
Fixed in WordPress 3.8.26
3.9.18
Fixed in WordPress 3.9.24
4.0.17
Fixed in WordPress 4.0.23
4.1.17
Fixed in WordPress 4.1.23
4.2.14
Fixed in WordPress 4.2.20
4.3.10
Fixed in WordPress 4.3.16
4.4.9
Fixed in WordPress 4.4.15
4.5.8
Fixed in WordPress 4.5.14
4.6.5
Fixed in WordPress 4.6.11
4.7.4
Fixed in WordPress 4.7.10
4.7.5
Fixed in WordPress 4.7.10
3.7.21
Fixed in WordPress 3.7.26
3.8.21
Fixed in WordPress 3.8.26
3.9.19
Fixed in WordPress 3.9.24
4.0.18
Fixed in WordPress 4.0.23
4.1.18
Fixed in WordPress 4.1.23
4.2.15
Fixed in WordPress 4.2.20
4.3.11
Fixed in WordPress 4.3.16
4.4.10
Fixed in WordPress 4.4.15
4.5.9
Fixed in WordPress 4.5.14
4.6.6
Fixed in WordPress 4.6.11
4.8
Fixed in WordPress 4.8.6
4.8.1
Fixed in WordPress 4.8.6
3.7.22
Fixed in WordPress 3.7.26
3.8.22
Fixed in WordPress 3.8.26
3.9.20
Fixed in WordPress 3.9.24
4.0.19
Fixed in WordPress 4.0.23
4.1.19
Fixed in WordPress 4.1.23
4.2.16
Fixed in WordPress 4.2.20
4.3.12
Fixed in WordPress 4.3.16
4.4.11
Fixed in WordPress 4.4.15
4.5.10
Fixed in WordPress 4.5.14
4.6.7
Fixed in WordPress 4.6.11
4.7.6
Fixed in WordPress 4.7.10
4.8.2
Fixed in WordPress 4.8.6
4.8.3
Fixed in WordPress 4.8.6
3.7.23
Fixed in WordPress 3.7.26
3.8.23
Fixed in WordPress 3.8.26
3.9.21
Fixed in WordPress 3.9.24
4.0.20
Fixed in WordPress 4.0.23
4.1.20
Fixed in WordPress 4.1.23
4.2.17
Fixed in WordPress 4.2.20
4.3.13
Fixed in WordPress 4.3.16
4.4.12
Fixed in WordPress 4.4.15
4.5.11
Fixed in WordPress 4.5.14
4.6.8
Fixed in WordPress 4.6.11
4.7.7
Fixed in WordPress 4.7.10
4.9
Fixed in WordPress 4.9.5
4.9.1
Fixed in WordPress 4.9.5
4.8.4
Fixed in WordPress 4.8.6
4.7.8
Fixed in WordPress 4.7.10
4.6.9
Fixed in WordPress 4.6.11
4.5.12
Fixed in WordPress 4.5.14
4.4.13
Fixed in WordPress 4.4.15
4.3.14
Fixed in WordPress 4.3.16
4.2.18
Fixed in WordPress 4.2.20
4.1.21
Fixed in WordPress 4.1.23
4.0.21
Fixed in WordPress 4.0.23
3.9.22
Fixed in WordPress 3.9.24
3.8.24
Fixed in WordPress 3.8.26
3.7.24
Fixed in WordPress 3.7.26
4.9.2
Fixed in WordPress 4.9.5
4.8.5
Fixed in WordPress 4.8.6
4.7.9
Fixed in WordPress 4.7.10
4.6.10
Fixed in WordPress 4.6.11
4.5.13
Fixed in WordPress 4.5.14
4.4.14
Fixed in WordPress 4.4.15
4.3.15
Fixed in WordPress 4.3.16
4.2.19
Fixed in WordPress 4.2.20
4.1.22
Fixed in WordPress 4.1.23
4.0.22
Fixed in WordPress 4.0.23
3.9.23
Fixed in WordPress 3.9.24
3.8.25
Fixed in WordPress 3.8.26
3.7.25
Fixed in WordPress 3.7.26
4.9.3
Fixed in WordPress 4.9.5
4.9.4
Fixed in WordPress 4.9.5

References

CVE
CVE-2018-10100
URL
https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/
URL
https://github.com/WordPress/WordPress/commit/14bc2c0a6fde0da04b47130707e01df850eedc7e

Classification

Type
REDIRECT
OWASP top 10
A1: Injection
CWE
CWE-601
CVSS
6.1 (medium)

Miscellaneous

Submitter
Ryan
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
01b587e0-0a86-47af-a088-6e5e350e8247

Timeline

Publicly Published
2018-04-03 (about 6 years ago)
Added
2018-04-04 (about 6 years ago)
Last Updated
2020-09-22 (about 3 years ago)

Other

Published
Title
Published
2019-05-18
Title
Newsletter Manager < 1.5 - Unauthenticated Open Redirect
Published
2023-04-27
Title
WP Directory Kit < 1.2.0 - Open Redirect
Published
2022-02-16
Title
Page Builder KingComposer <= 2.9.6 - Open Redirect
Published
2023-07-18
Title
Ninja Popups <= 4.7.5 - Unauthenticated Open Redirect
Published
2023-09-01
Title
Login and Logout Redirect <= 2.0.2 - Open Redirect