The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.

Samuel Sidler reports :

WordPress 4.4.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.4.1 and earlier are affected by two security issues: a possible SSRF for certain local URIs, reported by Ronni Skansing; and an open redirection attack, reported by Shailesh Suthar.

Versions of WordPress prior to 4.4.2 are susceptible to the following vulnerabilities : 

 - A flaw exists that allows a cross-site redirection attack. This flaw exists because the application does not validate certain input. This could allow a context-dependent attacker to create a specially crafted link that, if followed, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appears to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client-side software such as a web browser or document rendering programs, as well as phishing attacks that mimic the legitimate site but send user-supplied information to the attacker. (CVE-2016-2221)
 - A flaw exists in 'src/wp-includes/http.php' related to request handling between a user and a server, where the server can be induced into performing unintended actions (Server Side Request Forgery, or SSRF). By making a crafted request that leverages certain local URIs, the server can be used to conduct host-based attacks. This may allow an attacker to bypass access restrictions (e.g. host or network ACLs), conduct port scanning of internal networks, enumerate internal hosts, or possibly invoke additional protocols (e.g. Gopher, TFTP) which may provide additional control over such requests. (CVE-2016-2222)

WordPress versions 4.4.1 and earlier are affected by two security issues: a possible Side Request Forgery Vulnerability for certain local URIs, reported by Ronni Skansing; and an open redirection attack, reported by Shailesh Suthar.

CVE-2016-2221 Wordpress could be vulnerable for an open redirection attack which was fixed by better validation of the URL used in HTTP redirects.

CVE-2016-2222 It was discovered that Wordpress was susceptible for a possible Side Request Forgery Vulnerability because it considered for instance 0.1.2.3 as a valid IP.

For Debian 6 'Squeeze', these problems have been fixed in version 3.6.1+dfsg-1~deb6u9.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in wordpress, a web blogging tool.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-2221     Shailesh Suthar discovered an open redirection     vulnerability.

  - CVE-2016-2222     Ronni Skansing discovered a server-side request forgery     (SSRF) vulnerability.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.4.2.
It is, therefore, affected by the following vulnerabilities :

  - A cross-site redirection vulnerability exists due to a     failure by the application to validate certain input.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted link, to redirect a victim from     a legitimate web site to an arbitrary web site of the     attacker's choosing, thus allowing further attacks on     client-side software, such as web browsers or document     rendering software. (CVE-2016-2221)

  - A server-side request forgery vulnerability exists in     which the server can be induced into performing     unintended actions when handling certain requests. An     unauthenticated, remote attacker can exploit this, via     crafted requests to certain local URIs, to conduct     further host-based attacks, such as bypassing access     restrictions, conducting port scanning, enumerating     internal networks and hosts, or invoking additional     protocols. (CVE-2016-2222)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
89729	FreeBSD : wordpress -- multiple vulnerabilities (fef03980-e4c6-11e5-b2bd-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
9074	WordPress < 4.4.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
88766	Debian DLA-418-1 : wordpress security update	Nessus	Debian Local Security Checks	high
88631	Debian DSA-3472-1 : wordpress - security update	Nessus	Debian Local Security Checks	high
88579	WordPress < 4.4.2 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2016-2222

high

Tenable Plugins

high

medium

high

high

high