CVE-2017-8295Wordpress Vulnerability
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be…
Published May 4, 2017 · Updated Aug 4, 2026 · Also known as 254b5dd2-c3d9-45d9-8328-6cc8ef29c9db, DEBIAN-CVE-2017-8295, DLA-975-1, DSA-3870-1, UBUNTU-CVE-2017-8295, WORDFENCE-254b5dd2-c3d9-45d9-8328-6cc8ef29c9db
Key Facts
Patch immediately- CVE-2017-8295 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Wordpress.
- It is exploited in the wild, listed in Industry KEV feed since Jan 26, 2022. Public exploit code is available.
- EPSS estimates a 27% probability of exploitation in the next 30 days.
- Fixed versions are available, including Wordpress 3.6.1+dfsg-1~deb7u15, Wordpress 4.1+dfsg-1+deb8u14, Wordpress 4.7.5+dfsg-2.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (30-day exploit likelihood)
27%
Higher than 98.0% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
40/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Jan 26, 2022
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
2
Reports of active use
Advisories And Exploit References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2017-8295
- advisoryhttps://ubuntu.com/security/CVE-2017-8295
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2017-8295
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/254b5dd2-c3d9-45d9-8328-6cc8ef29c9db?source=api-prod
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/254b5dd2-c3d9-45d9-8328-6cc8ef29c9db?source=api-scan
- advisory98295
Description
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function.
Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Jan 26, 2022 | n/a | Not reported |
Affected Products
14 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| WordpressWordpress | See advisory | 4.7.4 |
Patched Releases
Wordpress
3.6.1+dfsg-1~deb7u15, 4.1+dfsg-1+deb8u14, 4.7.5+dfsg-2, 5.5, 4.7.4
Timeline
Publicly disclosed
May 4, 2017
Added to Industry KEV feed
Jan 26, 2022
Last updated
Aug 4, 2026
Weakness Type
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
References
- advisorysecurity-tracker.debian.org · CVE-2017-8295
- advisoryubuntu.com · CVE-2017-8295
- advisorycve.org · CVERecord
- advisorywordfence.com · 254b5dd2-c3d9-45d9-8328-6cc8ef29c9db
- advisorywordfence.com · 254b5dd2-c3d9-45d9-8328-6cc8ef29c9db
FAQ
Common Questions.
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the res…
Affected: Wordpress. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Jan 26, 2022.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Wordpress 3.6.1+dfsg-1~deb7u15, Wordpress 4.1+dfsg-1+deb8u14, Wordpress 4.7.5+dfsg-2.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2017-8295 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo