AIKIDO-2026-880241

johnpbloch/wordpress-core is vulnerable to Denial of Service (DoS)

Denial of Service (DoS) Pre-CVE Published 2 days ago

Medium Risk

This Affects:

johnpbloch/wordpress-core

3.4.0 - 4.7.37

Fixed in 4.7.38

4.8.0 - 4.8.32

Fixed in 4.8.33

4.9.0 - 4.9.33

Fixed in 4.9.34

5.0.0 - 5.0.29

Fixed in 5.0.30

5.1.0 - 5.1.26

Fixed in 5.1.27

5.2.0 - 5.2.28

Fixed in 5.2.29

5.3.0 - 5.3.25

Fixed in 5.3.26

5.4.0 - 5.4.23

Fixed in 5.4.24

5.5.0 - 5.5.22

Fixed in 5.5.23

5.6.0 - 5.6.21

Fixed in 5.6.22

5.7.0 - 5.7.19

Fixed in 5.7.20

5.8.0 - 5.8.17

Fixed in 5.8.18

5.9.0 - 5.9.18

Fixed in 5.9.19

6.0.0 - 6.0.16

Fixed in 6.0.17

6.1.0 - 6.1.14

Fixed in 6.1.15

6.2.0 - 6.2.13

Fixed in 6.2.14

6.3.0 - 6.3.12

Fixed in 6.3.13

6.4.0 - 6.4.12

Fixed in 6.4.13

6.5.0 - 6.5.12

Fixed in 6.5.13

6.6.0 - 6.6.9

Fixed in 6.6.10

6.7.0 - 6.7.9

Fixed in 6.7.10

6.8.0 - 6.8.10

Fixed in 6.8.11

6.9.0 - 6.9.9

Fixed in 6.9.10

7.0.0 - 7.0.6

Fixed in 7.0.7

7.1.0 - 7.1.2

Fixed in 7.1.3

Are you affected? Scan for Free

TL;DR

johnpbloch/wordpress-core repeats a ../ cleanup inside WP_Http::make_absolute_url() while the path still contains ../. A relative path such as a//../b never changes, so the request loops until PHP stops it. The URL details endpoint passes a remote page's icon or image address into that function, and a Contributor can point the preview at a page they control. The fix stops the loop when one replacement removes nothing.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

johnpbloch/wordpress-core is vulnerable to Denial of Service (DoS) in versions 3.4.0 - 4.7.37, 4.8.0 - 4.8.32, 4.9.0 - 4.9.33, 5.0.0 - 5.0.29, 5.1.0 - 5.1.26, 5.2.0 - 5.2.28, 5.3.0 - 5.3.25, 5.4.0 - 5.4.23, 5.5.0 - 5.5.22, 5.6.0 - 5.6.21, 5.7.0 - 5.7.19, 5.8.0 - 5.8.17, 5.9.0 - 5.9.18, 6.0.0 - 6.0.16, 6.1.0 - 6.1.14, 6.2.0 - 6.2.13, 6.3.0 - 6.3.12, 6.4.0 - 6.4.12, 6.5.0 - 6.5.12, 6.6.0 - 6.6.9, 6.7.0 - 6.7.9, 6.8.0 - 6.8.10, 6.9.0 - 6.9.9, 7.0.0 - 7.0.6 and 7.1.0 - 7.1.2.