WordPress Security Release 7.0.3 Fixes High Severity XSS Vulnerability via @sejournal, @martinibuster

WordPress announced a security release 7.0.3 to fix twelve vulnerabilities, three of which appear to be fairly serious, with one vulnerability rated 8.9/10 High.

Twelve WordPress Vulnerabilities In Core

In the past it’s been relatively rare for vulnerabilities to be discovered in WordPress but recently there have been an unusual cluster of vulnerability discoveries, aided by AI.

There are twelve vulnerabilities and the official WordPress announcement only provides the bare minimum description of what they are and zero severity information, making it hard for the average WordPress users to understand the urgency and importance of the patches.

These are the twelve vulnerabilities:

A Contributor+ stored cross-site scripting (XSS) issue in the Post Date block A Contributor+ stored cross-site scripting (XSS) issue in the Post Content block An information disclosure issue in the Latest Comments block exposing comments on password-protected posts A bypass of the email address confirmation flow An Author+ CSS injection issue via a bypass of the safe CSS attribute filter A Contributor+ stored cross-site scripting (XSS) issue in posts via the emoji settings element A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges A pre-auth reflected cross-site scripting (XSS) issue on the login screen with potential to lead to PHP code execution A disclosure of notes in comment feeds An enumeration of post slugs A Contributor+ stored cross-site scripting (XSS) issue in Quick Edit on sites with a large number of users

Of those, three are probably of the highest/higher concern:

Pre-auth XSS on the login screen with potential PHP code execution
This is confirmed to be rated as a high severity vulnerability. SSRF allowing requests to link-local ranges
This is potentially serious but there is no information about it right now to know for certain. SSRF means Server-Side Request Forgery. For this context, link-local IP ranges are IP addresses that are reserved for internal communication within the server. Put all that together and the minimal description of this vulnerability implies that the vulnerability enables server-side requests to link-local IP ranges which can expose sensitive information on the server. But there is no description of this vulnerability, so we can only infer from the bare information given. A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site.
This vulnerability enables the unauthorized ability to create another site on the network. That could be an issue for institutional sites like universities but also to those with multisite installations.

High Severity Rated XSS Vulnerability

Quite likely the most concerning vulnerability in the list is the one described as a Pre-Auth XSS. XSS means Cross-Site Scripting.

The Open Worldwide Application Security Project (OWASP) describes XSS like this:

“Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.”

Pre-auth XSS on the login screen with potential PHP code execution

That’s rated 8.9/10. That vulnerability is labeled as “Pre-auth” which means that an attacker does not need a WordPress account to launch an attack, but that’s mitigated to a certain extent because the exploitation still requires user interaction, someone with an account on the site needs to be tricked into performing an action (aka social engineering).

The official WordPress GitHub security repo explains this vulnerability says that it can lead to remote code execution (RCE):

“WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.

Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.

This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.”

Oliver Sild of Patchstack tweeted on X about the XSS vulnerability:

“Weeks ago when #WP2Shell dropped and OpenAI Sol Ultra took most of the credit – all I thought about was how all the other labs and AI-pentest companies will rush to prove they can find something in the WordPress core too.

Well, today, 3 weeks later – we have the next WordPress core version release with not one, but 12 vulnerabilities being patched. And as expected, the issues have been reported by @AnthropicAI, @pwn_ai, @AikidoSecurity, and others.

The nastiest one is a login screen XSS, which via some social engineering could lead to Remote Code Execution. Luckily, WordPress is auto-updating fast and none of the vulnerabilities are mass-exploitable like WP2Shell was.

As always, @patchstackapp customers received mitigation rules right at the disclosure.”

Oliver Sild also told Search Engine Journal that they’re tracking if hackers are exploiting the XSS vulnerability:

“We’re tracking whether it’s getting exploited, but looks like the social engineering bit on the XSS that could lead to RCE is most likely not going to get much attention from the hackers.”

Featured Image by Shutterstock/Jihan Nafiaa Zahri