CVE-2011-4957: Input Validation
The makeclickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4957?
CVE-2011-4957 is classified as a high severity vulnerability that can lead to denial of service on affected WordPress versions.
How do I fix CVE-2011-4957?
To fix CVE-2011-4957, upgrade your WordPress installation to version 3.1.1 or later.
Which versions of WordPress are affected by CVE-2011-4957?
CVE-2011-4957 affects all WordPress versions prior to 3.1.1.
What kind of attack can exploit CVE-2011-4957?
An attacker can exploit CVE-2011-4957 by submitting a specially crafted URL in comments, causing a denial of service.
Is there a workaround for CVE-2011-4957 if I cannot upgrade?
There are no recommended workarounds for CVE-2011-4957 other than upgrading to a patched version of WordPress.