WordPress version 3.6 suffers from multiple URL redirection restriction bypass vulnerabilities…. WordPress version 3.6 suffers from multiple URL redirection restriction bypass vulnerabilities.

Read more http://packetstormsecurity.com/files/123589/CVE-2013-4339.pdf