CVE-2017-8295 in WordPress
Zusammenfassung
von MITRE
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for user-assisted remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this e-mail to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.