Executive brief
WordPress contains a security flaw in its 'Press This' feature, which is used for quickly publishing content from around the web. Due to improper access controls, unauthorized users can view the interface for assigning categories and tags to posts. This allows an attacker to see internal site terms and organizational structures that should be restricted to administrators or editors.
Technical details
A vulnerability exists in wp-admin/includes/class-wp-press-this.php within the 'Press This' component of WordPress. The application fails to perform adequate capability checks before displaying the user interface for assigning taxonomy terms (categories and tags). As a result, remote attackers can access this interface and read existing terms without having the necessary permissions to manage them. This is classified as an information exposure vulnerability (CWE-200). The issue was addressed in WordPress version 4.7.2 by implementing proper permission checks to ensure the UI is only visible to authorized users.
Affected products
- WordPress WordPress < 4.7.2
Timeline
- 2017-01-26: patched: WordPress 4.7.2 released
- 2017-01-30: disclosed: NVD publication date
References
- http://www.debian.org/security/2017/dsa-3779
- http://www.openwall.com/lists/oss-security/2017/01/28/5
- http://www.securityfocus.com/bid/95816
- http://www.securitytracker.com/id/1037731
- https://codex.wordpress.org/Version_4.7.2
- https://github.com/WordPress/WordPress/commit/21264a31e0849e6ff793a06a17de877dd88ea454
- https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/