Unrated severityNVD Advisory· Published Nov 25, 2014· Updated Jun 17, 2026
CVE-2014-9038
CVE-2014-9038
Description
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
11cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: <=3.7.4
- cpe:2.3:a:wordpress:wordpress:3.8:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.9:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:4.0:*:*:*:*:*:*:*
- (no CPE)range: <3.7.5, 3.8.x<3.8.5, 3.9.x<3.9.3, 4.x<4.0.1
Patches
Vulnerability mechanics
References
7- wordpress.org/news/2014/11/wordpress-4-0-1/nvdPatchVendor Advisory
- core.trac.wordpress.org/changeset/30444nvdVendor Advisory
- advisories.mageia.org/MGASA-2014-0493.htmlnvd
- openwall.com/lists/oss-security/2014/11/25/12nvd
- www.debian.org/security/2014/dsa-3085nvd
- www.mandriva.com/security/advisoriesnvd
- www.securitytracker.com/id/1031243nvd
News mentions
0No linked articles in our index yet.