WordPress core vulnerability affects millions of sites

WordPress announced that it has patched four vulnerabilities, and these vulnerabilities are scored as high as 8 on a scale of 1 to 10. These vulnerabilities exist in the WordPress core itself and are caused by defects introduced by the WordPress development team itself.

Four WordPress vulnerabilities

The WordPress announcement did not specify the severity of the vulnerability, and the details were few.

However, the US government’s National Vulnerability Database, which records and publishes vulnerabilities, ranks vulnerabilities as 8.0 on a scale of 1 to 10, with 10 representing the highest risk level.

The four vulnerabilities are:

1. SQL injection due to lack of data cleaning in WP_Meta_Query (high severity rating, 7.4)
2. Authenticated object injection in multiple sites (severity level is medium 6.6)
3. Store cross-site scripting (XSS) with authenticated users (high severity, 8.0)
4. Due to improper cleaning, SQL injection is performed through WP_Query (high severity, 8.0)

Three-quarters of the vulnerabilities were discovered by security researchers outside of WordPress. WordPress doesn’t know until they get notified.

These vulnerabilities were privately disclosed to WordPress, which allowed WordPress to fix the problems before they became widely known.

Is WordPress developing in a dangerous way?

The development of WordPress slowed down in 2021 because they could not complete the work of the latest version 5.9, which saw WordPress postponed until later in 2022.

WordPress has been talking about reducing the scale of development. The core WordPress developers themselves warned about the speed of development and begged for more time.

One of the developers warn:

“In general, now we seem to be rushing in a dangerous way.”

Given that WordPress is unable to comply with its release schedule and is discussing reducing the 2022 release calendar from four versions to three versions, people have to question the speed of WordPress development and whether more efforts should be made to ensure that the loopholes are not Will be released to the public inadvertently.

Data cleaning issues in WordPress

Data cleaning is a method of controlling what kind of information is obtained through input and entered into the database. The database stores information about the site, including passwords, user names, user information, content, and other information required for the operation of the site.

WordPress documentation Describe data cleaning:

“Sanitization is the process of cleaning or filtering input data. Regardless of whether the data comes from a user or an API or Web service, you can use sanitization when you don’t know what will happen or do not want to strictly verify the data.”

The document states that WordPress should include built-in help functions to prevent malicious input, and using these help functions requires minimal effort.

According to WordPress’ own documentation, these vulnerabilities are expected, so it is surprising that they appear in the core of WordPress itself.

There are two advanced vulnerabilities related to improper cleanup:

• WordPress: SQL injection due to improper cleanup in WP_Meta_Query
  Due to the lack of proper cleanup in WP_Meta_Query, there is a possibility of blind SQL injection
• WordPress: SQL injection through WP_Query
  Due to improper cleanup in WP_Query, in some cases, SQL injection may be performed through plugins or themes that use it in some way.

Other vulnerabilities are:

• WordPress: authenticated object injection in multisite
  On multi-sites, users with super administrator roles can bypass explicit/extra reinforcement through object injection under certain conditions.
• WordPress: XSS stored by authenticated users
  Low-privileged authenticated users (such as authors) in the core of WordPress can execute JavaScript/execute stored XSS attacks, which will affect high-privileged users.

WordPress recommends updating immediately

Since the vulnerability is now public, WordPress users must ensure that their WordPress installation is updated to the latest version, which is currently 5.8.3.

WordPress recommends updating and installing immediately.

Citation

Read the official WordPress notice

WordPress 5.8.3 secure release

National Vulnerability Database Report

Authenticated object injection in multisite

XSS stored by authenticated user

Improper disinfection in WP_Query

SQL injection due to improper cleanup in WP_Meta_Query