WordPress vulnerabilities

WordPress through version 4.8.2 uses a weak MD5-based password hashing algorithm, making it easier for attackers to determine cleartext values by leveraging access to the hash values.

In WordPress before version 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF vulnerability.

In WordPress before version 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.

In WordPress before version 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.

In WordPress before version 4.7.5, there is improper handling of post meta data values in the XML-RPC API.

A directory traversal vulnerability in the wp_ajax_update_plugin function in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php.

The CSRF vulnerability in WordPress before version 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving Flash file uploads.

WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

WordPress versions before 4.5.3 allow remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.

WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.

WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.

WordPress versions before 4.5.3 allow remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.

The wp_http_validate_url function in WordPress before version 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.

A vulnerability in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via remote file inclusion. The issue exists in wp-links/links.all.php, where attackers can manipulate the $abspath variable.

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website, it is possible to escalate to RCE, but requires social engineering and explicit interaction by the victim. This issue affects all versions of WordPress; version 7.0.3 has been released with a fix, backported to all branches back to 4.7.

The Word Count and Social Shares WordPress plugin through version 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks. This allows any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g., by deleting wp-config.php).

WordPress versions before 4.8.3 are affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries, leading to potential SQL injection (SQLi) in plugins and themes.

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, potentially allowing SQL injection attacks via plugins and themes.

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. This issue affects multiple WordPress versions from 6.6 through 7.1.2.

The WordPress plugin is vulnerable to DOM-Based Cross-Site Scripting due to improper neutralization of input during web page generation. This affects versions from n/a through 7.1.

WordPress is vulnerable to remote code execution via malicious Postscript file upload by an Author level user or higher, when Imagick and Ghostscript are in use on the server.

WordPress plugin admin-word-count-column 2.2 contains a local file read vulnerability allowing unauthenticated attackers to read arbitrary files by exploiting null byte injection in the path parameter. Attackers can send GET requests to download-csv.php with a crafted path parameter containing directory traversal sequences and null bytes to bypass file restrictions and read sensitive files like system configuration.

The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.0.5. Missing nonce validation on the options page allows unauthenticated attackers to change the site's active theme by modifying the jbct_theme option via a forged request, provided they trick a site administrator into clicking a link.

WordPress versions from 4.7 through 6.8.2 are vulnerable to stored XSS due to improper neutralization of input during web page generation. The vulnerability requires Author or higher privileges to exploit.

WordPress Core contains an Insertion of Sensitive Information Into Sent Data vulnerability that may allow retrieval of embedded sensitive data. The issue affects versions from 4.7 through 6.8.2 and requires Contributor-level privileges to exploit. The WordPress Core security team is aware and working on a fix; this is a low-severity vulnerability.

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress up to version 2.2.0 is vulnerable to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions can inject arbitrary scripts that execute when a page is visited.

Exposure of Sensitive Information to an Unauthorized Actor in WordPress in many versions from 4.1 to 6.3.1. The exact mechanism is not described, but it involves data exposure.