Host-driven canonical open redirect

Summary

Host-derived canonical redirect construction can reflect an attacker-controlled Host value into a redirect target, producing an open redirect and cache-poisoning condition.

Affected Products

WordPress core 7.0.4; canonical redirect handling.

Affected Scope

Product

WordPress

Component

Canonical redirect subsystem

Affected function

redirect_canonical(); HTTP Host/X-Forwarded-Host handling; Location header

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-601; CWE-346

Technical Summary

The redirect decision trusts request-derived host data instead of binding the target to the configured site origin.

Prerequisites and Permissions

Unauthenticated HTTP access to a deployment that enables canonical redirects and accepts attacker-controlled host headers.

Affected Locations

wp-includes/canonical.php: redirect_canonical(); request host/scheme inputs; Location response header.

Reproducible Proof

A controlled request with a substituted host produced a redirect whose target reflected that host under the documented deployment conditions.

Vulnerable Code

$redirect_url = apply_filters( &class="tok-comment">#39;redirect_canonical', $redirect_url, $requested_url );
if ( ! $redirect_url || strip_fragment_from_url( $redirect_url ) === strip_fragment_from_url( $requested_url ) ) {
	return;
}
if ( $do_redirect ) {
	if ( ! redirect_canonical( $redirect_url, false ) ) {
		wp_redirect( $redirect_url, 301 );
		exit;
	}
}

Severity

low

Technical Analysis

redirect_canonical() constructs canonical URLs using request host/scheme information. When host trust is not constrained, a supplied Host value can influence the Location response before the request reaches a trusted canonical host.

Impact

Integrity/security impact: phishing and cache poisoning against deployments that cache redirects or trust the canonical URL. No authenticated data access is claimed.

Remediation

Use a configured canonical host allow-list, ignore untrusted Host values, validate redirects against site_url/home_url, and add proxy/cache regression tests.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.