AIKIDO-2026-62450

roots/wordpress is vulnerable to Denial of Service (DoS)

Denial of Service (DoS) Pre-CVE Published 2 days ago

Medium Risk

This Affects:

roots/wordpress

3.7.38 - 5.6.21

Fixed in 5.6.22

5.7 - 5.7.19

Fixed in 5.7.20

5.8 - 5.8.17

Fixed in 5.8.18

5.9 - 5.9.18

Fixed in 5.9.19

6.0 - 6.0.16

Fixed in 6.0.17

6.1 - 6.1.14

Fixed in 6.1.15

6.2 - 6.2.13

Fixed in 6.2.14

6.3 - 6.3.12

Fixed in 6.3.13

6.4 - 6.4.12

Fixed in 6.4.13

6.5 - 6.5.12

Fixed in 6.5.13

6.6 - 6.6.9

Fixed in 6.6.10

6.7 - 6.7.9

Fixed in 6.7.10

6.8 - 6.8.10

Fixed in 6.8.11

6.9 - 6.9.9

Fixed in 6.9.10

7.0 - 7.0.6

Fixed in 7.0.7

7.1 - 7.1.2

Fixed in 7.1.3

Are you affected? Scan for Free

TL;DR

roots/wordpress repeats a ../ cleanup inside WP_Http::make_absolute_url() while the path still contains ../. A relative path such as a//../b never changes, so the request loops until PHP stops it. The URL details endpoint passes a remote page's icon or image address into that function, and a Contributor can point the preview at a page they control. The fix stops the loop when one replacement removes nothing.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

roots/wordpress is vulnerable to Denial of Service (DoS) in versions 3.7.38 - 5.6.21, 5.7 - 5.7.19, 5.8 - 5.8.17, 5.9 - 5.9.18, 6.0 - 6.0.16, 6.1 - 6.1.14, 6.2 - 6.2.13, 6.3 - 6.3.12, 6.4 - 6.4.12, 6.5 - 6.5.12, 6.6 - 6.6.9, 6.7 - 6.7.9, 6.8 - 6.8.10, 6.9 - 6.9.9, 7.0 - 7.0.6 and 7.1 - 7.1.2.