Executive brief
WordPress is a widely used content management system for building websites and blogs. A security flaw was identified where the system failed to properly clean theme names when displaying them in the administrative dashboard. If an attacker can trick an administrator into interacting with a specially named theme directory, they could execute malicious scripts in the administrator's browser, potentially leading to unauthorized site changes or account takeover.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in WordPress versions prior to 4.7.1. The flaw is located in the theme-name fallback functionality within `wp-includes/class-wp-theme.php` and is related to how `wp-admin/includes/class-theme-installer-skin.php` handles theme metadata. The root cause is insufficient sanitization of the theme directory name when the theme's 'Name' header is missing or invalid. An attacker can exploit this by providing a crafted directory name containing HTML or JavaScript. When an administrator views the theme details or installation status, the script executes in their security context. This issue was patched in WordPress 4.7.1 by ensuring proper escaping of the fallback theme name.
Affected products
- WordPress WordPress < 4.7.1
Timeline
- 2017-01-11: patched: Fixed in WordPress version 4.7.1
- 2017-01-14: disclosed: Public disclosure via WordPress security release notes
- 2017-01-15: advisory: NVD publication date
References
- http://www.debian.org/security/2017/dsa-3779
- http://www.openwall.com/lists/oss-security/2017/01/14/6
- http://www.securityfocus.com/bid/95402
- http://www.securitytracker.com/id/1037591
- https://codex.wordpress.org/Version_4.7.1
- https://github.com/WordPress/WordPress/commit/ce7fb2934dd111e6353784852de8aea2a938b359
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/