CVE-2018-10101
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the...
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- Record
CVE-2018-10101- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- Record
CVE-2018-10101- Updated
- 2026-11-02
EUVDEUVD-2018-2180 No score
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- Record
EUVD-2018-2180- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ccmp-622j-3xf7
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the...
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- Record
GHSA-ccmp-622j-3xf7- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- Record
CVE-2018-10101- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-10101
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- Record
DEBIAN-CVE-2018-10101- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-10101
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- Record
UBUNTU-CVE-2018-10101- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10101 is a medium vulnerability (CVSS 6.1) in Wordpress, published April 14, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.64%, the 85th percentile. Fixed in wordpress 4.9.5+dfsg1-1.
References
wpvulndb.com/vulnerabilities/9053
securityfocus.com/bid/104350
securitytracker.com/id/1040836
debian.org/security/2018/dsa-4193
wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release
core.trac.wordpress.org/changeset/42894
Show 7 moreShow less
codex.wordpress.org/Version_4.9.5
github.com/WordPress/WordPress/commit/804363859602d4050d9a38a21f5a65d9aec18216
nvd.nist.gov/vuln/detail/CVE-2018-10101
security-tracker.debian.org/tracker/CVE-2018-10101
ubuntu.com/security/CVE-2018-10101
cve.org/CVERecord?id=CVE-2018-10101