CVE-2013-4339: wordpress Improper Input Validation
CVSS: 7.5v2.0HighModified
AliasesUBUNTU-CVE-2013-4339DEBIAN-CVE-2013-4339
Published 12-09-2013Last modified 06-08-2024
Vulnerability summary
CVE-2013-4339 is a high (CVSS 7.5) Improper Input Validation vulnerability in wordpress. EPSS estimates a 7.59% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 3.6.1.
CVSS score
7.5/10
010
High · v2.0 (NVD)EPSS score
7.59%
0%100%
Low · +0.10 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 12-09-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.
CVSS metrics
2 scores · 2 sources · 2 versionsMedium 5.4Preferred score · wordfence (Source)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LSourcesSingle source
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
7.59%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
+0.10 pp
From 7.49% on 19-09-2026
19-09-202619-10-2026
EPSS score7.59%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (core.trac.wordpress.org)
Maturity: unknown
Exploit Reference (core.trac.wordpress.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Wordpress2 products
- wordpress≤ 3.6 (fixed in 3.6.1)
- wordpress≤ 3.6
Debian1 product
- wordpress< 3.6.1+dfsg-1
Ubuntu1 product
- wordpress< 3.6.1+dfsg-1
3 vendors · 4 products
References
14 links- lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.htmlVendor AdvisoryX Refsource FEDORA