WordPress developers announced on Thursday the availability of version 5.0.1 of the content management system (CMS), which addresses several types of vulnerabilities.
Researcher Tim Coen has discovered several cross-site scripting (XSS) flaws in WordPress, including one caused by the ability of contributors to edit new comments from users with higher privileges. He also found that a specially crafted URL input can be exploited for XSS attacks – this issue only impacts some plugins.
Coen and researcher Slavco Mihajloski discovered an XSS vulnerability related to the ability of authors on Apache-hosted websites to upload specially crafted files that bypass MIME verification.
“Prior to 5.0.1, WordPress did not require uploaded files to pass MIME type verification, so files could be uploaded even if the contents didn’t match the file extension. For example, a binary file could be uploaded with a .jpg extension,” explained WordPress developer Ian Dunn. “This is no longer the case, and the content of uploaded files must now match their extension. Most valid files should be unaffected, but there may be cases when a file needs to be renamed to its correct extension (e.g., an OpenOffice doc going from .pptx to .ppxs).”
Mihajloski found numerous WordPress vulnerabilities in the past months, but he is displeased with the way the developers of the CMS handle security reports. He says it takes a long time for flaws to get patched and researchers are often provided no feedback.
Researchers at Yoast discovered that, in some uncommon configurations, the user activation screen could be indexed by search engines, leading to the exposure of email addresses and possibly some default passwords. However, WordPress developers noted that the passwords are only exposed in “some rare cases.”
Karim El Ouerghemmi informed WordPress that authors could alter metadata and delete files that they normally would not be authorized to delete. Another metadata-related issue was reported by Sam Thomas, who found that contributors could use specially crafted metadata for PHP object injection.
Finally, Simon Scannell of RIPS Technologies discovered that authors could leverage specially crafted input to create posts of unauthorized types.
For users who have yet to update to version 5.0, the patches have also been included in updates for WordPress 4.9 and older releases.
Related: Unpatched WordPress Flaw Leads to Site Takeover, Code Execution
Related: Hackers Exploit Flaw in GDPR Compliance Plugin for WordPress
Related: WordPress Disables Plugins That Expose e-Commerce Sites to Attacks
Related: Attackers Exploit Recently Patched Popular WordPress Plugin