CVE-2017-5491 Wordpress CVE debrief

Who should care

Administrators and operators of WordPress sites that use wp-mail.php or any mail-driven posting workflow should review their exposure, especially if they still run WordPress 4.7 or earlier. Security teams managing hosted WordPress estates, plugins or integrations that rely on email posting, and vendors that package WordPress should also verify patch status.

Technical summary

The NVD record describes the flaw as an intended posting restriction bypass in wp-mail.php, triggered through a spoofed mail server using the mail.example.com name. The vulnerable product scope is WordPress versions up to and including 4.7, with remediation in 4.7.1. NVD assigns CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network reachability with low complexity and limited integrity impact. NVD also maps the weakness to CWE-1188.

Defensive priority

Moderate. The issue is remotely reachable and requires no privileges or user interaction according to the CVSS vector, but the documented impact is limited to integrity and the affected version range is narrow. Prioritize patching if any WordPress 4.7 or earlier systems remain in service, especially those using mail-based publishing features.

Recommended defensive actions

• Upgrade WordPress to version 4.7.1 or later.
• Verify whether wp-mail.php or any email-to-post workflow is enabled or exposed in your deployment.
• Review site logs and mail-handling configuration for unexpected mail server name handling.
• Treat the vendor release notes and patch commit as the authoritative remediation references.
• If you distribute or operate packaged WordPress instances, confirm the fixed version is included in your baseline.

Evidence notes

This debrief is based only on the supplied CVE record and its referenced official or source-listed materials. The CVE was published on 2017-01-15 and later modified on 2026-05-13, but the vulnerability itself should be understood using the original CVE publication context and the vendor release references. The source corpus states that WordPress before 4.7.1 is affected, that wp-mail.php is involved, and that the issue may allow bypass of intended posting restrictions via a spoofed mail server named mail.example.com. No exploit details beyond the supplied description are included.

Official resources