High severity7.4NVD Advisory· Published May 22, 2016· Updated Jun 17, 2026
CVE-2016-2221
CVE-2016-2221
Description
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
Affected products
2cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: <=4.4.1
- (no CPE)range: <4.4.2
Patches
Vulnerability mechanics
References
7- codex.wordpress.org/Version_4.4.2nvdPatch
- core.trac.wordpress.org/changeset/36444nvdPatch
- wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/nvdPatchVendor Advisory
- www.debian.org/security/2016/dsa-3472nvd
- www.securityfocus.com/bid/82463nvd
- www.securitytracker.com/id/1034933nvd
- wpvulndb.com/vulnerabilities/8377nvd
News mentions
0No linked articles in our index yet.