Executive brief
WordPress, a popular website management platform, contains a security flaw in how it handles plugin updates. An authorized user with low-level access (such as a Subscriber) can bypass security checks to view sensitive plugin data they should not be able to see. This could allow an attacker to gather information about the site's configuration or potentially cause a service disruption.
Technical details
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress versions prior to 4.6 contains an improper access control vulnerability. The function calls get_plugin_data() before verifying the 'update_plugins' capability or validating CSRF tokens. A remote authenticated attacker, even with low privileges like a Subscriber, can exploit this by sending a crafted request to wp-admin/admin-ajax.php with a specific plugin parameter. This allows the attacker to bypass intended read-access restrictions and potentially trigger a path traversal or denial of service condition. The issue was addressed in WordPress 4.6 by moving capability and CSRF checks to the beginning of the affected AJAX handlers.
Affected products
- WordPress WordPress before 4.6
Timeline
- 2016-07-12: disclosed: Vulnerability discovered by Yorick Koster
- 2016-08-16: patched: Fixed in WordPress version 4.6
- 2017-01-18: advisory: NVD published CVE-2016-10148