title: WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
description: WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
vendor: WordPress
product: WordPress
versions:
status: affected, versionType: custom, version: 4.1.30, lessThanOrEqual: 6.1.1
defaultStatus: affected
}