WordPress vulnerability means don’t save sensitive information in drafts
Secunia has reported the following vulnerability in WordPress 2.3.1:
Michael Brooks has discovered a vulnerability in WordPress, which can be exploited by malicious people to bypass certain security restrictions and to disclose sensitive information.
The application does not properly restrict access to posted drafts to users with valid administrator credentials. [my emphasis] This can be exploited to read drafts by accessing the index.php script with data in the “PATH_INFO” URL part ending with “wp-admin/”.
This vulnerability has been confirmed in WordPress version 2.3.1, but other versions may be affected.
So what does this mean, everyone?
- Don’t post any information that you wish to keep private in a draft post.
- We’re in for a WordPress upgrade pretty soon!
Is it just me, or does WordPress seem to have many more vulnerabilities and security issues than other platforms? Or does it just seem like that since I’m so involved in the WordPress world, or because WordPress has such a wide community that bazillions of people are constantly scrutinizing the software?
Category: News & Views
I think the main reason for WordPress security updates and reports being so common is due to it’s popularity. More people using it means more people finding holes and more people trying to take advantage of holes.
The thing is though … who cares if drafts are in insecure? Surely no one would store particularly sensitive information in them?
The only way I could see this being a problem is if sploggers managed to access them and posted them before you did, which could potentially lead to your content being picked up as a duplicate of the splogger instead of the other way around due to theirs being published first.
I read recently that WordPress have no intentions of an update until 2.4 is released some time in January/February. So maybe they’ll stick to that schedule.
[...] releasing any new versions until 2.3, we now are faced with WordPress version 2.3.2, which fixes the draft vulnerability we wrote about recently, as well as “suppress[ing] some error messages that can give away [...]