WordPress core

CVE-2019-17669

WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.

Severity: Critical 9.8
Published: 17 Oct 2019
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.2.4
Sources: NVD

Affected software

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	Every version before 5.2.4

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2019-17669
CVE.org https://www.cve.org/CVERecord?id=CVE-2019-17669