BIT-wordpress-multisite-2020-4046: Medium severity WordPress WordPress vulnerability

Q: Which users and workflows create the practical exposure?

Sites are exposed when low-privileged users such as contributors or authors can create posts using the embed block, and a higher-privileged user later views the affected post in the block editor or wp-admin. The resulting script execution is in the higher-privileged user's administrative context.

Q: Does exploitation require an unauthenticated attacker or direct administrator interaction?

The attacker needs a low-privileged account capable of creating the relevant content. Exploitation also requires a higher-privileged user to view the malicious post; it is not described as a fully unauthenticated or no-interaction attack.

Q: Which WordPress releases contain the fix?

The issue is patched in WordPress 5.4.2 and in minor releases for earlier affected branches: 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, and 3.7.34.

Published Jun 12, 2020

Updated

In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Affected Software

1 affected component

WordPress WordPress<5.4.2, <5.3.4, <5.2.7, <5.1.6, <5.0.10, <4.9.15, <4.8.14, <4.7.18, <4.6.19, <4.5.22, <4.4.23, <4.3.24, <4.2.28, <4.1.31, <4.0.31, <3.9.32, <3.8.34, <3.7.34

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress to a version that resolves this vulnerability.
Fixed in 5.4.2

Event History

Jun 12, 2020

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverity

Frequently Asked Questions

Which users and workflows create the practical exposure?

Sites are exposed when low-privileged users such as contributors or authors can create posts using the embed block, and a higher-privileged user later views the affected post in the block editor or wp-admin. The resulting script execution is in the higher-privileged user's administrative context.

Does exploitation require an unauthenticated attacker or direct administrator interaction?

The attacker needs a low-privileged account capable of creating the relevant content. Exploitation also requires a higher-privileged user to view the malicious post; it is not described as a fully unauthenticated or no-interaction attack.

Which WordPress releases contain the fix?

The issue is patched in WordPress 5.4.2 and in minor releases for earlier affected branches: 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, and 3.7.34.

BIT-wordpress-multisite-2020-4046: Medium severity WordPress WordPress vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users and workflows create the practical exposure?

Does exploitation require an unauthenticated attacker or direct administrator interaction?

Which WordPress releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which users and workflows create the practical exposure?

Does exploitation require an unauthenticated attacker or direct administrator interaction?

Which WordPress releases contain the fix?