CVE-2018-10100
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if...
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- Record
CVE-2018-10100- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- Record
CVE-2018-10100- Updated
- 2026-11-02
EUVDEUVD-2018-2179 No score
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- Record
EUVD-2018-2179- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ch98-pvvc-v52h
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if...
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- Record
GHSA-ch98-pvvc-v52h- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- Record
CVE-2018-10100- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-10100
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- Record
DEBIAN-CVE-2018-10100- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-10100
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- Record
UBUNTU-CVE-2018-10100- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
before 4.9.5+dfsg1-1 | 4.9.5+dfsg1-1 |
wordpressDebian:13 |
before 4.9.5+dfsg1-1 | 4.9.5+dfsg1-1 |
wordpressDebian:14 |
before 4.9.5+dfsg1-1 | 4.9.5+dfsg1-1 |
wordpressDebian:7 From an advisory covering 2 CVEs |
before 3.6.1+dfsg-1~deb7u21, plus listed versions 3.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-1 Show 28 moreShow less3.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u53.6.1+dfsg-1~deb6u63.6.1+dfsg-1~deb6u73.6.1+dfsg-1~deb6u83.6.1+dfsg-1~deb6u93.6.1+dfsg-1~deb7u13.6.1+dfsg-1~deb7u103.6.1+dfsg-1~deb7u113.6.1+dfsg-1~deb7u123.6.1+dfsg-1~deb7u133.6.1+dfsg-1~deb7u143.6.1+dfsg-1~deb7u153.6.1+dfsg-1~deb7u163.6.1+dfsg-1~deb7u173.6.1+dfsg-1~deb7u183.6.1+dfsg-1~deb7u193.6.1+dfsg-1~deb7u23.6.1+dfsg-1~deb7u203.6.1+dfsg-1~deb7u33.6.1+dfsg-1~deb7u43.6.1+dfsg-1~deb7u53.6.1+dfsg-1~deb7u63.6.1+dfsg-1~deb7u83.6.1+dfsg-1~deb7u9 |
3.6.1+dfsg-1~deb7u21 |
wordpressDebian:8 From an advisory covering 2 CVEs |
before 4.1+dfsg-1+deb8u17, plus listed versions 4.1+dfsg-14.1+dfsg-1+deb8u14.1+dfsg-1+deb8u104.1+dfsg-1+deb8u114.1+dfsg-1+deb8u12 Show 12 moreShow less4.1+dfsg-1+deb8u134.1+dfsg-1+deb8u144.1+dfsg-1+deb8u154.1+dfsg-1+deb8u164.1+dfsg-1+deb8u24.1+dfsg-1+deb8u34.1+dfsg-1+deb8u44.1+dfsg-1+deb8u54.1+dfsg-1+deb8u64.1+dfsg-1+deb8u74.1+dfsg-1+deb8u84.1+dfsg-1+deb8u9 |
4.1+dfsg-1+deb8u17 |
wordpressDebian:9 From an advisory covering 2 CVEs |
before 4.7.5+dfsg-2+deb9u3, plus listed versions 4.7.5+dfsg-24.7.5+dfsg-2+deb9u14.7.5+dfsg-2+deb9u1~bpo8+14.7.5+dfsg-2+deb9u24.7.5+dfsg-2+deb9u2~bpo8+1 |
4.7.5+dfsg-2+deb9u3 |
wordpressUbuntu:16.04:LTS |
All versions, plus listed versions 4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10100 is a medium vulnerability (CVSS 6.1) in Wordpress, published April 14, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in wordpress 4.9.5+dfsg1-1.
References
securitytracker.com/id/1040836
core.trac.wordpress.org/changeset/42892
wpvulndb.com/vulnerabilities/9054
debian.org/security/2018/dsa-4193
wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release
lists.debian.org/debian-lts-announce/2018/04/msg00031.html
Show 7 moreShow less
codex.wordpress.org/Version_4.9.5
github.com/WordPress/WordPress/commit/14bc2c0a6fde0da04b47130707e01df850eedc7e
nvd.nist.gov/vuln/detail/CVE-2018-10100
security-tracker.debian.org/tracker/CVE-2018-10100
ubuntu.com/security/CVE-2018-10100
cve.org/CVERecord?id=CVE-2018-10100