Executive brief
A security weakness in WordPress Multisite could allow unauthorized users to bypass registration restrictions. The system used predictable random numbers when generating activation keys for new sites or user accounts. This could allow an attacker to guess these keys and activate accounts or sites without proper authorization, potentially leading to unauthorized access or site creation.
Technical details
The vulnerability exists in `wp-includes/ms-functions.php` within the WordPress Multisite API. The software utilized a cryptographically weak pseudo-random number generator (PRNG) to generate activation keys for new user and site signups. Because the generated keys were predictable, a remote attacker could potentially guess a valid key. This allows for the bypass of intended access restrictions, enabling the unauthorized activation of accounts or sites. The issue was addressed in version 4.7.1 by migrating to the more secure `wp_rand()` function for key creation.
Affected products
- WordPress WordPress < 4.7.1
Timeline
- 2017-01-11: patched: WordPress version 4.7.1 released
- 2017-01-14: disclosed: Public disclosure via oss-security mailing list
- 2017-01-15: advisory: NVD publication date
References
- http://www.debian.org/security/2017/dsa-3779
- http://www.openwall.com/lists/oss-security/2017/01/14/6
- http://www.securityfocus.com/bid/95401
- http://www.securitytracker.com/id/1037591
- https://codex.wordpress.org/Version_4.7.1
- https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/