WordPress has released version 7.0.3, which includes security fixes for twelve different vulnerabilities in the software’s core. Three of these issues are particularly noteworthy, with the most severe one having a score of 8.9 out of 10.
The WordPress security update addresses issues ranging from stored cross-site scripting flaws in content editing blocks to a privilege escalation vulnerability and a high severity cross-site scripting vulnerability on the login page, among others. This kind of update should be a priority for any website owner who uses the popular CMS, as updates addressing core security issues are not made frequently, and some of the discovered vulnerabilities could be potentially abused.
A Larger Than Usual Cluster of Vulnerabilities
Security vulnerabilities found in WordPress core tend to be relatively rare occurrences, which makes this one notable. This release is part of an unusual recent cluster of vulnerability discoveries in WordPress. In recent times, there has been an explosion of research into WordPress security, done by humans and increasingly aided by AI, which is able to spot vulnerabilities that might have taken manual testing days if not weeks to catch.
The post on the official WordPress blog about this particular vulnerability release does little to explain or detail any of the security flaws beyond their names, with no risk assessment given for any of them. This leaves the average WordPress user, who probably has no extensive knowledge of WordPress security, uncertain as to both the relevance of the update as well as the priority of this list of twelve issues.
The Full List of Twelve Vulnerabilities
The vulnerabilities fixed in the update included a stored cross-site scripting (XSS) vulnerability in the Post Date block for Contributor-level users, a similar stored XSS flaw in the Post Content block, and an information disclosure vulnerability in the Latest Comments block, which made it possible to view comments on posts that were password-protected.
Amongst the other flaws fixed in the security update were the bypassing of email address confirmation, a CSS injection vulnerability in the Comment section that bypassed the protection that used safe CSS attributes for users with Author-level access, and a Contributor-level stored XSS vulnerability related to the emoji settings element in posts.
The update also fixed a privilege escalation vulnerability on a multisite network with user registration enabled that allowed unauthorized site creation on the network by an unprivileged user.
The researcher also reported a server-side request forgery vulnerability in the URL validation component that attempted to access link-local IP addresses and a pre-authentication reflected XSS vulnerability on the login page that could lead to PHP code execution.
The security update also fixed a number of other vulnerabilities, including one that allowed access to notes left in the comment area, a post slug enumeration vulnerability, and a Contributor-level stored XSS vulnerability in Quick Edit, which was especially dangerous for WordPress installations with many registered users.
The Three Vulnerabilities That Matter Most
Out of the twelve, three issues pose the highest level of severity to the majority of the site owners. The pre-authentication XSS vulnerability on the login page is confirmed as high severity, and it’s the one security researchers are treating as the most concerning of the batch. This vulnerability is regarded as the most severe among the discovered ones.
The other two issues that should raise concerns are the server-side request forgery vulnerability, which affects the link-local IP range, and the privilege escalation vulnerability existing in the multisite network. Both problems are severe, but the first one’s impact is difficult to estimate since there is not enough technical information about it. Server-side request forgery vulnerabilities generally allow sending HTTP requests from the server to any destination, which would be possible due to insufficient validation in the application. The link-local IP range refers to IPs that are only used in the server’s local network, which means that this vulnerability might provide an attacker with access to some internal resources. Since there is not enough information about this vulnerability, it is challenging to estimate the potential impact and damage.
The privilege escalation vulnerability in the WordPress multisite network is also a significant security issue. The problem is that an unauthorized user can create a new blog in the network. It might be a considerable problem for the companies that use the WordPress platform as their websites’ CMS and allow users to register on their websites.
A Closer Look at the Login Screen XSS Vulnerability
The vulnerability that caused the most hype among the security community is the modus operandi for pre-authentication cross-site scripting attack that targets the login page of WordPress. This vulnerability has a CVSS score of 8.9.
The cross-site scripting vulnerability, often abbreviated XSS, is one of the most common ways attackers use to deliver malware to unwary website visitors. According to the Open Worldwide Application Security Project, the XSS attack is a vulnerability that occurs when an untrusted source inputs data into a web application without proper encoding thus creating an involuntary output from the web application. Attackers can use this security flaw to lure unsuspecting web application users into running their malicious scripts that subsequently tricks the browser into thinking that an untrusted site is a trusted one thus resulting in compromising of the user’s session. The vulnerability that was discovered recently, is a pre-authentication cross-site scripting flaw that is found in WordPress login page. This makes the vulnerability particularly dangerous since the attacker would not be required to login prior to attacking the application.
However, a closer inspection reveals that the vulnerability would require the attacker to somehow convince the victim to interact with the attacker’s malicious web application or payload. According to the advisory report published on the company’s GitHub repository, the attack that was demonstrated could be used to execute remote code; however, the attacker would first have to lure the victim into visiting their site then the code would be executed remotely. The report further adds that the vulnerability affects all versions of wp-admin. The vulnerability is present in WordPress 7.0.3 which will be available later today. The company has also backported the security update to 4.7 for the users running on that branch.
What Security Researchers Are Saying
Oliver Sild of the WordPress security company Patchstack spoke about the vulnerability disclosure on X, noting that the issues were reported by Anthropic along with other AI-focused security and penetration-testing companies. He stated that the login screen XSS vulnerability was the most concerning discovered since it could lead to remote code execution on the servers via social engineering but that, due to WordPress’s rapid support and update process, it is less likely to be widely abused compared to similar past WordPress core security issues.
Sild also told Search Engine Journal that Patchstack is tracking whether the login screen XSS vulnerability is being exploited in the wild. He explained that, based on his assessment, the social engineering aspect required for the more severe effect seemed to diminish the likelihood of it being widely used as it demanded extra and unpredictable effort from the threat actors, unlike automated exploits.
What WordPress Site Owners Should Do
Considering several of these issues are potentially very serious (in particular, the vulnerability affecting the login screen), it is recommended that users of these sites take care to update their installations to WordPress 7.0.3 as soon as possible. Of course, it is normal that most WordPress users run the latest version of the software since all official security updates are automatically applied through normal ways of WordPress functioning. Thus, if you run an old version of a theme or plugin which is no longer supported, make sure everything was updated to the latest revision.
In the case of using the WordPress multisite network with the possibility for anyone to register at your site, it is strongly advised to check that this vulnerability is fixed in your installation since it allows for privilege escalation to the level of admin on a target WordPress installation.
Bottom Line
WordPress 7.0.3 addresses twelve different vulnerabilities including one particularly dangerous flaw that would allow an attacker to execute arbitrary code on the server via the login screen. The problem was patched in all versions of the CMS going back to 4.7, and WordPress’s speedy update mechanism should reduce the amount of time the software spends exposed. Still, it’s up to the site maintainers to keep their WordPress installations up-to-date (if they have not done so already) as it may take some time for the changes to propagate throughout the ecosystem.
FAQs
Q1: What does WordPress 7.0.3 fix?
WordPress 7.0.3 addresses twelve different security issues found in the application’s core, including several stored cross-site scripting vulnerabilities and an easily exploitable XSS vulnerability in the login page.
Q2: What is the most serious vulnerability in this release?
The most severe vulnerability addressed in WordPress 7.0.3 is an XSS vulnerability in the login page with a severity score of 8.9 out of 10. In addition, it is a pre-authentication issue that allows remote code execution when a victim is convinced to open a malicious link.
Q3: What does “pre-auth” mean in this context?
It means that to take advantage of the vulnerability, an attacker would not need to authenticate themselves on the target WordPress site. With that said, the attacker would need to lure the victim into clicking on a malicious link.
Q4: How far back has the fix been backported?
The fix has been backported to all releases of WordPress starting from 4.7 for the convenience of the users running older versions of the CMS.
Q5: What is cross-site scripting (XSS)?
Cross-site scripting (XSS) is a security vulnerability that allows an attacker to inject malicious scripts into a website that runs in the victim’s browser.
Q6: What is the server-side request forgery vulnerability about?
The server-side request forgery vulnerability is associated with improper URL validation that puts the data accessible on the link-local IP address range at risk. The specific details of the vulnerability have not been publicly disclosed yet.
Q7: Who discovered these vulnerabilities?
According to Patchstack’s Oliver Sild, the problems were discovered by several AI-focused cybersecurity and penetration testing companies.
Q8: Is this vulnerability being actively exploited right now?
According to Patchstack, they are not certain whether the vulnerability is actively weaponized; however, the probability is low due to the social engineering needed to get users to click the malicious link.
