CVE-2017-6815 (wordpress)

In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.

Source: CVE-2017-6815 (wordpress)