Executive brief
WordPress, a widely used website management platform, was found to have a security flaw that could allow attackers to take over a user's session. By tricking an authenticated user into visiting a malicious link or interacting with a specially crafted Flash file, an attacker could perform actions on the website as if they were that user. This could lead to unauthorized changes to the website or access to sensitive administrative functions.
Technical details
A cross-site request forgery (CSRF) vulnerability exists in WordPress versions prior to 4.7.1. The flaw is rooted in how the application handles Flash file uploads, which can be leveraged to bypass CSRF protections. An unauthenticated remote attacker can exploit this by inducing a logged-in user (such as an administrator) to interact with a malicious vector involving a Flash file. Successful exploitation allows the attacker to hijack the victim's session and perform unauthorized actions with the victim's privileges. This issue was addressed in the WordPress 4.7.1 security and maintenance release.
Affected products
- WordPress WordPress < 4.7.1
Timeline
- 2017-01-11: patched: WordPress 4.7.1 released
- 2017-01-14: disclosed: CVE assigned and public mailing list discussion
- 2017-01-15: advisory: NVD publication date
References
- http://www.debian.org/security/2017/dsa-3779
- http://www.openwall.com/lists/oss-security/2017/01/14/6
- http://www.securityfocus.com/bid/95399
- http://www.securitytracker.com/id/1037591
- https://codex.wordpress.org/Version_4.7.1
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/
- https://wpvulndb.com/vulnerabilities/8717