WordPress silently fixes dangerous code injection vulnerability

The flaw could allow unauthenticated users to modify any post or page in a WordPress site

Developers of the widely used WordPress content management system released an update last week, but intentionally delayed announcing that the patch addressed a severe vulnerability.

WordPress version 4.7.2 was released on January 26 as a security update, but the accompanying release notes only mentioned fixes for three moderate risk vulnerabilities, one of which did not even affect the platform's core code.

On Wednesday, a week later, the WordPress security team disclosed that a fourth vulnerability, much more serious than the others, was also patched in version 4.7.2.

The vulnerability was discovered by researchers from web security firm Sucuri and was reported privately to the WordPress team on January 20. It's located in the platform's REST API (application programming interface) and allows unauthenticated attackers to modify the content of any post or page within a WordPress site.

"We believe transparency is in the public’s best interest," WordPress core developer Aaron Campbell said in a blog post Wednesday. "It is our stance that security issues should always be disclosed. In this case, we intentionally delayed disclosing this issue by one week to ensure the safety of millions of additional WordPress sites."

According to Campbell, after learning about the flaw, the WordPress developers reached out to security companies that maintain popular web application firewalls (WAFs) so they can deploy protection rules against possible exploits. They then contacted large WordPress hosting companies and advised them on how to implement protections for their customers before an official patch was released.

The vulnerability only affects WordPress 4.7 and 4.7.1, where the REST API is enabled by default. Older versions are not affected, even if they have the REST API plug-in.

"We’d also like to thank the WAFs and hosts who worked closely with us to add additional protections and monitored their systems for attempts to use this exploit in the wild," Campbell said. "As of today, to our knowledge, there have been no attempts to exploit this vulnerability in the wild."

While that's good news, it doesn't mean that attackers won't start exploiting this vulnerability now that the information is out. WordPress is the most popular website building platform, which makes it a very attractive target for hackers.

Webmasters should make sure that they update their WordPress sites to version 4.7.2 as soon as possible if they haven't done it yet.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?