cve/2016/CVE-2016-2221.md

### [CVE-2016-2221](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2221)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.

### POC

#### Reference
- https://wpvulndb.com/vulnerabilities/8377

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Afetter618/WordPress-PenTest
- https://github.com/mimmam1464/codepath-projects
- https://github.com/mohammad-a-immam/codepath-projects