WordPress Hit With Multiple Vulnerabilities In Versions Prior To 6.0.3

WordPress has released a security update to address multiple vulnerabilities found in versions prior to 6.0.3 and has also updated all versions since WordPress 3.7.

Cross Site Scripting (XSS) Vulnerability

The U.S. Government’s National Vulnerability Database issued warnings about several vulnerabilities impacting WordPress. Among these is the Cross Site Scripting (XSS) vulnerability, which can occur when WordPress fails to properly sanitize inputs from forms or uploads. This can allow attackers to send a malicious script to a site user, potentially exposing sensitive information or user credentials.

Another identified issue is a Stored XSS vulnerability, which is more severe than standard XSS attacks. In this case, the malicious script is stored on the website and executed when a user or logged-in user visits the site.

Additionally, a Cross-Site Request Forgery (CSRF) vulnerability was discovered. The Open Web Application Security Project (OWASP) describes CSRF as an attack that forces users to execute unwanted actions on a web application in which they are authenticated. With social engineering tactics, attackers can trick users into performing actions such as transferring funds or changing email addresses. If the target is an admin, the attacker could compromise the entire web application.

Vulnerabilities Discovered

The specific vulnerabilities addressed in the update are:

1. Stored XSS via wp-mail.php (post by email)
2. Open redirect in wp_nonce_ays
3. Sender’s email address exposed in wp-mail.php
4. Media Library – Reflected XSS via SQLi
5. CSRF in wp-trackback.php
6. Stored XSS via the Customizer
7. Revert shared user instances introduced in 50790
8. Stored XSS in WordPress Core via Comment Editing
9. Data exposure via the REST Terms/Tags Endpoint
10. Content from multipart emails leaked
11. SQL Injection due to improper sanitization in WP_Date_Query
12. RSS Widget: Stored XSS issue
13. Stored XSS in the search block
14. Feature Image Block: XSS issue
15. RSS Block: Stored XSS issue
16. Fix widget block XSS

Recommended Action

WordPress has advised all users to update their websites immediately. The official WordPress announcement states:

"This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated."

Additional Information

• WordPress 6.0.3 Security Release
• National Vulnerability Database entries: CVE-2022-43504, CVE-2022-43500, CVE-2022-43497

Featured image by Shutterstock/Asier Romero