Improper access control in WordPress - CVE-2019-17671
Published: October 15, 2019 / Updated: November 20, 2019
Vulnerability identifier: #VU21789
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-17671
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists in the "WP_Query" due to improper access restrictions to private and draft posts. A remote unauthenticated attacker can use a method to view posts.
Example:
http://[host]/?static=1&order=asc
Affected software
WordPress
wordpress (Debian package)
wordpress (Debian package)
How to mitigate CVE-2019-17671
Install updates from vendor's website.
WordPress - addressed in versions 3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.15, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4
wordpress (Debian package) - addressed in versions 4.7.5+dfsg-2+deb9u6, 5.0.4+dfsg1-1+deb10u1, 5.0.4+dfsg1-1+deb10u2, 5.4.1+dfsg1-1
wordpress (Debian package) - addressed in versions 4.7.5+dfsg-2+deb9u6, 5.0.4+dfsg1-1+deb10u1, 5.0.4+dfsg1-1+deb10u2, 5.4.1+dfsg1-1
Links to Public Exploits and PoC-codes
External References
- https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
- https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
- https://github.com/WordPress/WordPress/commit/f82ed753cf00329a5e41f2cb6dc521085136f308
- https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/