WordPress Security Release 7.0.3 Fixes High Severity XSS Vulnerability

WordPress introduced a safety launch 7.0.3 to repair twelve vulnerabilities, three of which look like pretty severe, with one vulnerability rated 8.9/10 Excessive.

Twelve WordPress Vulnerabilities In Core

Previously it’s been comparatively uncommon for vulnerabilities to be found in WordPress however just lately there have been an uncommon cluster of vulnerability discoveries, aided by AI.

There are twelve vulnerabilities and the official WordPress announcement solely supplies the naked minimal description of what they’re and nil severity info, making it laborious for the common WordPress customers to grasp the urgency and significance of the patches.

These are the twelve vulnerabilities:

1. A Contributor+ saved cross-site scripting (XSS) difficulty within the Put up Date block
2. A Contributor+ saved cross-site scripting (XSS) difficulty within the Put up Content material block
3. An info disclosure difficulty within the Newest Feedback block exposing feedback on password-protected posts
4. A bypass of the e-mail tackle affirmation circulation
5. An Creator+ CSS injection difficulty by way of a bypass of the secure CSS attribute filter
6. A Contributor+ saved cross-site scripting (XSS) difficulty in posts by way of the emoji settings aspect
7. A privilege escalation difficulty on multisite networks with consumer registration enabled, permitting a consumer to create a brand new website
8. A server-side request forgery (SSRF) difficulty in URL validation permitting requests to link-local ranges
9. A pre-auth mirrored cross-site scripting (XSS) difficulty on the login display screen with potential to result in PHP code execution
10. A disclosure of notes in remark feeds
11. An enumeration of put up slugs
12. A Contributor+ saved cross-site scripting (XSS) difficulty in Fast Edit on websites with a lot of customers

Of these, three are most likely of the very best/greater concern:

1. Pre-auth XSS on the login display screen with potential PHP code execution
   That is confirmed to be rated as a excessive severity vulnerability.
2. SSRF permitting requests to link-local ranges
   That is probably severe however there isn’t any details about it proper now to know for sure. SSRF means Server-Facet Request Forgery. For this context, link-local IP ranges are IP addresses which might be reserved for inner communication inside the server. Put all that collectively and the minimal description of this vulnerability implies that the vulnerability permits server-side requests to link-local IP ranges which might expose delicate info on the server. However there isn’t any description of this vulnerability, so we are able to solely infer from the naked info given.
3. A privilege escalation difficulty on multisite networks with consumer registration enabled, permitting a consumer to create a brand new website.
   This vulnerability permits the unauthorized means to create one other website on the community. That could possibly be a difficulty for institutional websites like universities but in addition to these with multisite installations.

Excessive Severity Rated XSS Vulnerability

Fairly possible probably the most regarding vulnerability within the checklist is the one described as a Pre-Auth XSS. XSS means Cross-Website Scripting.

The Open Worldwide Software Safety Mission (OWASP) describes XSS like this:

“Cross-Website Scripting (XSS) assaults are a sort of injection, by which malicious scripts are injected into in any other case benign and trusted web sites. XSS assaults happen when an attacker makes use of an internet utility to ship malicious code, typically within the type of a browser aspect script, to a distinct finish consumer. Flaws that enable these assaults to succeed are fairly widespread and happen anyplace an internet utility makes use of enter from a consumer inside the output it generates with out validating or encoding it.

An attacker can use XSS to ship a malicious script to an unsuspecting consumer. The tip consumer’s browser has no option to know that the script shouldn’t be trusted, and can execute the script. As a result of it thinks the script got here from a trusted supply, the malicious script can entry any cookies, session tokens, or different delicate info retained by the browser and used with that website.”

Pre-auth XSS on the login display screen with potential PHP code execution

That’s rated 8.9/10. That vulnerability is labeled as “Pre-auth” which signifies that an attacker doesn’t want a WordPress account to launch an assault, however that’s mitigated to a sure extent as a result of the exploitation nonetheless requires consumer interplay, somebody with an account on the location must be tricked into performing an motion (aka social engineering).

The official WordPress GitHub security repo explains this vulnerability says that it may well result in distant code execution (RCE):

“WordPress is weak to a pre-auth mirrored XSS vulnerability on the login display screen.

By way of a specifically crafted malicious third-party web site hosted by an attacker, it’s attainable for this to be escalated to an RCE vulnerability with situations outdoors of the attackers management. This requires profitable social engineering of and express interplay by the goal sufferer.

This difficulty impacts all variations of WordPress. Model 7.0.3 has been launched, containing a repair for the vulnerability, and as a courtesy to customers on older branches the repair has been backported to all branches again to 4.7.”

Oliver Sild of Patchstack tweeted on X about the XSS vulnerability:

“Weeks in the past when #WP2Shell dropped and OpenAI Sol Extremely took a lot of the credit score – all I thought of was how all the opposite labs and AI-pentest firms will rush to show they’ll discover one thing within the WordPress core too.

Properly, as we speak, 3 weeks later – we’ve the subsequent WordPress core model launch with not one, however 12 vulnerabilities being patched. And as anticipated, the problems have been reported by @AnthropicAI, @pwn_ai, @AikidoSecurity, and others.

The nastiest one is a login display screen XSS, which by way of some social engineering may result in Distant Code Execution. Fortunately, WordPress is auto-updating quick and not one of the vulnerabilities are mass-exploitable like WP2Shell was.

As all the time, @patchstackapp clients obtained mitigation guidelines proper on the disclosure.”

Oliver Sild additionally advised Search Engine Journal that they’re monitoring if hackers are exploiting the XSS vulnerability:

“We’re monitoring whether or not it’s getting exploited, however seems just like the social engineering bit on the XSS that might result in RCE is almost definitely not going to get a lot consideration from the hackers.”

Featured Picture by Shutterstock/Jihan Nafiaa Zahri