WordPress versions 4.7.1 and earlier are vulnerable by three security issues
by CIRT Team
Description:
- The user interface for assigning taxonomy terms in Press is shown to users who do not have permissions to use it.
- WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue.
- A cross-site scripting (XSS) vulnerability was discovered in the posts list table.
- An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint
Impact: Intruder can take control of the web system by exploiting above mention vulnerabilities.
Mitigation: Vendor has released new version (WordPress 4.7.2.).
Reference URL’s:
- https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/
- https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
Recommended Posts
Cyber Threat Alert: Surge in Attacks via Compromised Third-Party Service Providers
08 Feb 2024 - Articles, English articles, Security Advisories & Alerts
Subscribe here
MEMBER OF:
