CERT-In Advisory
CIAD-2022-0027
Multiple Vulnerabilities in Wordpress
Original Issue Date: October 31, 2022
Severity Rating: High
Software Affected
- WordPress Core versions prior to 6.0.3
Overview
Multiple vulnerabilities have been reported in WordPress which could be exploited by a remote attacker to bypass security restrictions, conduct cross site scripting attacks, obtain potentially sensitive information, cross-site request forgery attacks or execute arbitrary code on the targeted system.
Description
1. Open Redirect Vulnerability
The vulnerability exists due to improper sanitization of user-supplied data in wp_nonce_ays. A remote non-authenticated attacker can exploit this vulnerability by tricking the victim to follow a specially crafted link and then redirect the victim to an arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
2. Reflected Cross-site Scripting Vulnerability
The vulnerability exists due to insufficient sanitization of user-supplied data in the Media Library. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary code in the user's browser in the context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to perform cross-site scripting (XSS) attacks.
3. Stored Cross-site Scripting Vulnerabilities
These vulnerabilities exist due to insufficient sanitization of user-supplied data in the functionalities like widget block, RSS block, Feature Image block, search block, RSS widget, Media Library, Customizer, Comment Editing feature and inwp-mail.php. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary script code in user's browser in the context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change the appearance of the web page, perform phishing and drive-by-download attacks and perform cross-site scripting (XSS) attacks.
4. Cross-site Request Forgery Vulnerability (CSRF)
The vulnerability exists due to insufficient validation of the HTTP request origin in wp-trackback.php. A remote attacker can exploit such an implementation to take over another user's Wordpress account.
Successful exploitation of the vulnerability may allow a remote attacker to trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
5. Information Disclosure
The vulnerability exists due to sender's email exposure in wp-mail.php and due to excessive data output when handling content from multipart emails.
Successful exploitation of the vulnerability may allow a remote attacker to gain access to potentially sensitive information.
6. SQL Injection Vulnerability
The vulnerability exists due to insufficient sanitization of user-supplied data within the WP_Date_Query() function. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete and modify data in the database.
7. Improper Access Control
The vulnerability exists due to improper access restrictions in the REST Terms/Tags Endpoint. A remote attacker can retrieve an unpublished post's terms or tag values, bypass implemented security restrictions and gain unauthorized access to the application.
Successful exploitation of this vulnerability may allow an attacker to gain access to sensitive data.
Solution
Apply appropriate fixes as issued by vendor in the following link:
https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/
Vendor Information
Wordpress
https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/
References
Wordpress
https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/
Wordfence
https://www.wordfence.com/blog/2022/10/patch-now-the-wordpress-6-0-3-security-update-contains-important-fixes/
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|