The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue. Per: http://cwe.mitre.org/data/definitions/918.html
'CWE-918: Server-Side Request Forgery (SSRF)'
Publication date: Tue, 09 Jul 2013 01:55:00 +0000