Django has an ALLOWED_HOSTS setting, which must be provided even in debug and test configurations. I'm surprised Wordpress doesn't have a similar setting; accepting any arbitrary Host can only cause trouble (at least for those uninformed sites which don't already prevent it at the web server level).
WordPress 4.8.1 still vulnerable to Host Header Attack
11–14 of 14 posts
Re: WordPress 4.8.1 still vulnerable to Host Header Attack
#12[deleted]
Re: WordPress 4.8.1 still vulnerable to Host Header Attack
#13A less inflamed take on the topic I found illuminating: https://pagely.com/blog/2017/05/exploitbox-unauthorized-pass...
More informative, but a nightmare to read. Thin gray font on a white background?
Re: WordPress 4.8.1 still vulnerable to Host Header Attack
#14It is open source so anyone could submit a PR for it though they might get more help if the drop svn and go with Github.