Executive brief
WordPress, a popular website management and blogging platform, was found to have a security flaw in its widget-editing accessibility feature. This vulnerability could allow an attacker to trick a logged-in administrator into performing unintended actions, such as modifying or deleting website widgets. If successfully exploited, this could lead to unauthorized changes to the website's appearance or functionality, potentially impacting the site's reputation and user experience.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in WordPress versions prior to 4.7.1 within the widget-editing accessibility-mode feature. The flaw is rooted in the lack of proper nonce (security token) validation in 'wp-admin/includes/class-wp-screen.php' and 'wp-admin/widgets.php'. A remote attacker can exploit this by inducing an authenticated user (typically an administrator) to visit a malicious URL or web page. Successful exploitation allows the attacker to perform 'widgets-access' actions on behalf of the victim, potentially leading to unauthorized modification of site widgets. The issue was addressed in version 4.7.1 by implementing mandatory nonce checks for these actions.
Affected products
- WordPress WordPress < 4.7.1
Timeline
- 2017-01-11: patched: WordPress version 4.7.1 released
- 2017-01-14: disclosed: Public disclosure via oss-security mailing list
- 2017-01-15: advisory: NVD publication date
References
- http://www.debian.org/security/2017/dsa-3779
- http://www.openwall.com/lists/oss-security/2017/01/14/6
- http://www.securityfocus.com/bid/95407
- http://www.securitytracker.com/id/1037591
- https://codex.wordpress.org/Version_4.7.1
- https://github.com/WordPress/WordPress/commit/03e5c0314aeffe6b27f4b98fef842bf0fb00c733
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/