CVE-2019-17675

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352 CWE-843

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.htmlThird Party Advisory
https://core.trac.wordpress.org/changeset/46477Patch, Vendor Advisory
https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00000.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/Release Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/9913Release Notes, Third Party Advisory
https://www.debian.org/security/2020/dsa-4599Third Party Advisory
https://www.debian.org/security/2020/dsa-4677Third Party Advisory
https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.htmlThird Party Advisory
https://core.trac.wordpress.org/changeset/46477Patch, Vendor Advisory
https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00000.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/Release Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/9913Release Notes, Third Party Advisory
https://www.debian.org/security/2020/dsa-4599Third Party Advisory
https://www.debian.org/security/2020/dsa-4677Third Party Advisory

Timeline

Published: Oct 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019