WordPress Core 4.7.0 — 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details

Overview

Advisory ID

bc5886e8-a520-48e4-9976-2e92b37e4bdf

Product

WordPress wordpress

Affected

≤7.1.2

Fixed in

4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

Weakness

CWE-835 Loop with Unreachable Exit Condition

Required access

Unknown

Published

Oct 7, 2026 · updated Nov 13, 2026

Credit

Anthropic

WordPress Core is vulnerable to Denial of Service in versions 4.7 through 7.1.2 because WP_Http::make_absolute_url() can enter a non-terminating loop when a malformed relative path contains a parent-directory component that its replacement expression cannot remove. In the demonstrated Core path, this makes it possible for authenticated attackers with Contributor-level access and above to occupy a PHP worker by asking the Block Editor URL Details endpoint to process attacker-controlled remote HTML containing a malformed relative icon or image URL. Repeated concurrent requests may reduce site availability.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.