{"id":"CVE-2013-0235","aliases":["DEBIAN-CVE-2013-0235","EUVD-2013-0268","GHSA-h9g4-hjrv-3hqw"],"status":"published","title":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to...","description":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.29565,"percentile":0.98202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-07-08T20:00:00Z","modified":"2026-09-01T20:03:14Z","exploits":[{"source":"metasploit","id":"auxiliary/scanner/http/wordpress_pingback_access","title":"Wordpress Pingback Locator","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access"}],"fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["3.5.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["3.5.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["3.5.1+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg-1"}]}]}],"products":[{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"http://codex.wordpress.org/Version_3.5.1","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://core.trac.wordpress.org/changeset/23330","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/","tags":["x_refsource_MISC","x_transferred","article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=904120","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://wordpress.org/news/2013/01/wordpress-3-5-1/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0235"},{"url":"http://wordpress.org/news/2013/01/wordpress-3-5-1"},{"url":"http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability"},{"url":"https://github.com/advisories/GHSA-h9g4-hjrv-3hqw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0235","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-0235","description":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.","status":"published","published":"2013-07-08T20:00:00Z","modified":"2024-09-16T19:46:35.36Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2013-0268","description":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.","status":"published","published":"2013-07-08T20:00:00Z","modified":"2024-09-16T19:46:35Z","updated_at":"2026-11-03T00:55:20.039201Z"}],"ghsa":[{"id":"GHSA-h9g4-hjrv-3hqw","title":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to...","description":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.","status":"published","published":"2022-05-05T02:48:38Z","modified":"2025-04-11T04:12:49Z","updated_at":"2026-11-02T15:01:14.028836Z"}],"nvd":[{"id":"CVE-2013-0235","description":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.","status":"published","published":"2013-07-08T20:55:00.883Z","modified":"2026-06-16T23:49:01.49Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"CVE-2013-0235","description":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.","status":"published","published":"2013-07-08T20:55:00Z","modified":"2026-04-10T03:43:16.899372Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0235","description":"The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.","status":"published","published":"2013-07-08T20:55:00.883Z","modified":"2026-09-01T20:03:14.676972828Z","updated_at":"2026-11-02T15:45:25.218101Z"}]}}