WordPress: Unauthenticated path traversal leading to conditional RCE

system2

pearcmd.php must exist, and register_argc_argv must be on, not common with hosting providers. But I am assuming the other themes and meeting conditions possibly affect a lot of WordPress sites.

tptacek

These CVSS scores don't mean anything and it would be better for everyone if they stopped showing up in headlines. This is a somewhat situational Wordpress RCE that impacts only a couple themes.

whycome

hmm, this may be why i just saw an unexpected update to a very old theme.

vntok

Ironically, this 9 years old comment on the official documentation page of one of the affected functions perfectly describes both the nature and remediation of this major security flaw: > Paul Ryan 9 years ago > Note that locate_template() does not prevent directory traversal attacks, so if you’re passing a user-provided template name to the function, be sure to verify that it’s from one of the three appropriate locations (active theme directory, parent theme directory, or /wp-includes/theme-compat/ directory). https://developer.wordpress.org/reference/functions/locate_t...

zelphirkalt

These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.

chrismorgan

The patch (identified from https://github.com/WordPress/wordpress-develop/compare/7.1.1... ): https://github.com/WordPress/wordpress-develop/commit/9c4e85...

random_savv

I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!

iLoveOncall

WordPress really is a piece of garbage software, and if you've ever developed plugins for it it is soooo apparent. The documentation is a perfect reflection of the absolute mess of spaghetti code that it is, half of the methods that you will use constantly when developing plugins are undocumented, even untyped. It's literally unusable. I know WordPress is good thanks to its ecosystem, but really, really, do NOT use it.

beezle

"WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7" As a courtesy, I try not to say more than one bad thing about WP every day. FWIW about 1/3 of installs are not on the recent 7 branch.

lyu07282

There is always this idea that the most used software also has the most vulnerabilities, but I think its an interesting question if this is actually true in light of AI. Like humans wouldn't spend a combined 100,000 hours or something looking at some obscure code, but an AI might do the equivalent across the entire ecosystem. Like if this idea is really true, we should see CVE's go into the millions per year soon, although I guess for now it's still bounded by compute budget but I question if the initial premise is true to begin with or if PHP is just shit. /s

Roscius

Using WordPress is like chewing discarded gum you find lying in the street.

PunchyHamster

It's a wonderful piece of software. We've had one of our clients wanting us to "just provide a simple PHP install for wordpress, just hosting" (among some more complex java stuff company wrote for them). Site hacked within a day from install. Thankfully we have limited outogoing traffic (whitelist on proxy) so only thing exploit managed to replace is their main page with our proxy's 403 error page, but damn, how this piece of software remains so shit till this day is massive achievement in incompetence. They also manage to fail on every level, like a simple problem of "a service behind a loadbalancer/reverse proxy" is still unsolved because devs refuse to support X-Forwarded-For header in core "because it's not official RFC", and also do not support official RFC for same feature.

cyphar

This kind of bug pathology is incredibly common in all sorts of programs and is the reason (disclaimer: self-plug) I wrote libpathrs[1]. Sadly, almost all language standard libraries do not provide the right abstractions for dealing with files (the primary focus is on global paths as opposed to scoped paths or file descriptors / file handles) so it's little surprise bugs like these just keep popping up every few weeks. To eliminate these from your codebase you need to rethink and really focus on being aware of how you deal with files. If the program you're writing has root privileges then you need to be more careful about misdirected writes to /proc or other pseudofilesystems. [1]: https://github.com/cyphar/libpathrs