New WordPress vulnerability: “Style” Cross-Site Scripting
A new vulnerability has been reported on Secunia in WordPress 2.2.1, and possibly in other versions:
DESCRIPTION: Benjamin Flesch has discovered a vulnerability in WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to the “style” parameter in wp-admin/upload.php (when “post_id” is set to a negative integer value) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
Successful exploitation requires that the target user has valid author or higher credentials.
The vulnerability is confirmed in version 2.2.1. Other versions may also be affected.
SOLUTION: Edit the source code to ensure that input is properly sanitised.
It doesn’t seem too serious, since it only applies to users with author or higher permissions. But my psychic powers tell me that we’re probably in for another WordPress upgrade in the near future. 2.2.2 here we come.
I know, I know. It’s impressive. You’re not worthy. Don’t feel bad: not everyone’s blessed with the ability to see into the future.
Category: News & Views
[...] few days ago I reported about a new WordPress vulnerability, and prophesied that as a result we would soon be witness to a new release of [...]