# CVE-2017-5491: WordPress bypass of posting restrictions in wp-mail.php

Source: https://junglewise.ai/threats/cve-2017-5491-wordpress-bypass-of-posting-restrictions-in-wp-mail-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-15. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5491 · Severity: medium · CVSS 5.3 · Published 2017-01-15

WordPress includes a feature that allows users to publish blog posts by sending an email to a specific address. A vulnerability in this feature could allow an unauthorized person to post content to a website by spoofing a default mail server address. This could lead to unauthorized content being published on the site, potentially damaging the organization's reputation or spreading misinformation.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2017-5491 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5491 being exploited in the wild.

**How severe is CVE-2017-5491?** Medium severity, with a CVSS score of 5.3, published 15 January 2017.

**Which products and versions are affected?** WordPress WordPress < 4.7.1.

**Is there a fix for CVE-2017-5491?** A patch was published on 2017-01-11: WordPress version 4.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5491 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2017-5491?** Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'Post via Email' functionality in WordPress (wp-mail.php) fails to properly validate the mail server source when default configuration settings are in place. Specifically, if the 'mailserver_url' setting is left as the default 'mail.example.com', an attacker can spoof a mail server with that name to bypass intended posting restrictions. This allows unauthenticated remote attackers to inject and publish posts on the affected WordPress site. The issue was addressed in version 4.7.1 by disabling wp-mail.php functionality when the default mail server URL is detected.

## Affected products

- WordPress WordPress < 4.7.1

## Timeline

- 2017-01-11: patched: WordPress version 4.7.1 released
- 2017-01-14: disclosed: Public disclosure via oss-security mailing list
- 2017-01-15: advisory: NVD publication date

## References

- [http://www.debian.org/security/2017/dsa-3779](http://www.debian.org/security/2017/dsa-3779)
- [http://www.openwall.com/lists/oss-security/2017/01/14/6](http://www.openwall.com/lists/oss-security/2017/01/14/6)
- [http://www.securityfocus.com/bid/95406](http://www.securityfocus.com/bid/95406)
- [http://www.securitytracker.com/id/1037591](http://www.securitytracker.com/id/1037591)
- [https://codex.wordpress.org/Version_4.7.1](https://codex.wordpress.org/Version_4.7.1)
- [https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df276fe3c8596a](https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df276fe3c8596a)
- [https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/](https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/)

## Related threats

- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)
- [WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt)
- [WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling)