Ticket #16449: incorrect_referer_check.patch

wp-includes/pluggable.php

@@ -825 +825 @@
         $adminurl = strtolower(admin_url());
         $referer = strtolower(wp_get_referer());
         $result = isset($_REQUEST[$query_arg]) ? wp_verify_nonce($_REQUEST[$query_arg], $action) : false;
-        if ( !$result && !(-1 == $action && strpos($referer, $adminurl) !== false) ) {
+        if ( !$result && !(-1 == $action && strpos($referer, $adminurl) === 0) ) {
                 wp_nonce_ays($action);
                 die();
         }