Is CVE-2017-5492 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5492 being exploited in the wild.

How severe is CVE-2017-5492?

High severity, with a CVSS score of 8.8, published 15 January 2017.

Is there a fix for CVE-2017-5492?

A patch was published on 2017-01-11: WordPress version 4.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5492 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-5492?

Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5492: WordPress CSRF in widget-editing accessibility mode

CVE-2017-5492 · Severity: high · CVSS 8.8 · Published 2017-01-15

WordPress, a popular website management and blogging platform, was found to have a security flaw in its widget-editing accessibility feature. This vulnerability could allow an attacker to trick a logged-in administrator into performing unintended actions, such as modifying or deleting website widgets. If successfully exploited, this could lead to unauthorized changes to the website's appearance or functionality, potentially impacting the site's reputation and user experience.

Technologies: Wordpress. Vendors: Wordpress.

Quick answers

Is CVE-2017-5492 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5492 being exploited in the wild.
How severe is CVE-2017-5492?: High severity, with a CVSS score of 8.8, published 15 January 2017.
Which products and versions are affected?: WordPress WordPress < 4.7.1.
Is there a fix for CVE-2017-5492?: A patch was published on 2017-01-11: WordPress version 4.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5492 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-5492?: Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in WordPress versions prior to 4.7.1 within the widget-editing accessibility-mode feature. The flaw is rooted in the lack of proper nonce (security token) validation in 'wp-admin/includes/class-wp-screen.php' and 'wp-admin/widgets.php'. A remote attacker can exploit this by inducing an authenticated user (typically an administrator) to visit a malicious URL or web page. Successful exploitation allows the attacker to perform 'widgets-access' actions on behalf of the victim, potentially leading to unauthorized modification of site widgets. The issue was addressed in version 4.7.1 by implementing mandatory nonce checks for these actions.

Affected products

WordPress WordPress < 4.7.1

Timeline

2017-01-11: patched: WordPress version 4.7.1 released
2017-01-14: disclosed: Public disclosure via oss-security mailing list
2017-01-15: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.