CVE-2017-5491
published 2017-01-15CVE-2017-5491: wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com…
PriorityP429medium5.3CVSS 3.0
AVNACLPRNUINSUCNILAN
EPSS
3.16%
86.6th percentile
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 4.7.1+dfsg-1 (bookworm) | wordpress 4.7.1+dfsg-1 (bookworm) |
| wordpress | wordpress | <= 4.7 | — |
| wordpress | wordpress | >= 0 < 4.7.1+dfsg-1 | 4.7.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.1+dfsg-1 | 4.7.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.1+dfsg-1 | 4.7.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.1+dfsg-1 | 4.7.1+dfsg-1 |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2017-5491: wordpress - wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass int...
vendor_debian·2017·CVSS 5.3
CVE-2017-5491 [MEDIUM] CVE-2017-5491: wordpress - wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass int...
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
Scope: local
bookworm: resolved (fixed in 4.7.1+dfsg-1)
bullseye: resolved (fixed in 4.7.1+dfsg-1)
forky: resolved (fixed in 4.7.1+dfsg-1)
sid: resolved (fixed in 4.7.1+dfsg-1)
trixie: resolved (fixed in 4.7.1+dfsg-1)
GHSA
GHSA-pqh4-x29p-6xrc: wp-mail
ghsa_unreviewed·2022-05-13
CVE-2017-5491 [MEDIUM] CWE-1188 GHSA-pqh4-x29p-6xrc: wp-mail
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
OSV
CVE-2017-5491: wp-mail
osv·2017-01-15·CVSS 5.3
CVE-2017-5491 [MEDIUM] CVE-2017-5491: wp-mail
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.debian.org/security/2017/dsa-3779http://www.openwall.com/lists/oss-security/2017/01/14/6http://www.securityfocus.com/bid/95406http://www.securitytracker.com/id/1037591https://codex.wordpress.org/Version_4.7.1https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df276fe3c8596ahttps://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8719http://www.debian.org/security/2017/dsa-3779http://www.openwall.com/lists/oss-security/2017/01/14/6http://www.securityfocus.com/bid/95406http://www.securitytracker.com/id/1037591https://codex.wordpress.org/Version_4.7.1https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df276fe3c8596ahttps://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8719
2017-01-15
Published