WordPress announced a security release to address seven security vulnerabilities plus four bug fixes. This security release, Version 7.1.3, addresses a stored XSS, denial-of-service DoS and five other vulnerabilities of undisclosed severity level. WordPress recommends updating sites immediately.
Seven Vulnerabilities
WordPress names seven vulnerabilities:
- Stored XSS
- DoS issue
- Second-Order SQL injection
- Weakness allowing Author role users to sticky posts
- Unauthenticated disclosure of comments
- Imgur embeds vulnerable to XSS
- Forgeable parameters that can lead to action name collision
The official announcement does not list severity ratings, CVSS scores,describe the vulnerabilities, or offer information of whether these vulnerabilities are being exploited in the the wild. However, WordPress recommends updating immediately.
The security fixes are also being backported to older WordPress branches eligible for security fixes, currently extending through WordPress 4.7, although those backports are still in progress. Backports will ship for older branches as they become ready.
Bug Fixes
The four bug fixes include three relatively benign issues that cause a poor user experience plus one that is critical.
Two of the bug fixes address oEmbed endpoints that return a 404 message. One is related to a music promotion platform and the other an eCard humor site. One of the fixes addresses a bug that may cause a website icon image in the admin to toolbar expand to gigantic proportions. The fourth can lead to a fatal error that sounds bad but probably isn’t that bad.
Critical Flaw Leads To Fatal Error
The fourth is a critical WordPress bug can make image uploads fail with a fatal error on hosts lacking an optional DOM library, leaving site owners unable to upload media. The WordPress ticket for this issue says that the image upload process stopped completely, so the image could not be uploaded. That sounds less bad than a complete page or site failure.
The missing component is PHP’s DOM extension (ext-dom), which provides the DOMDocument and DOMXPath classes WordPress was trying to use. The reason this problem may have arisen is that WordPress strongly recommends the extension but does not require it.
WordPress 7.0 introduced code that used DOMDocument without first checking whether the extension existed. On hosts without it, image uploads could trigger a fatal error and fail completely.
The WordPress ticket for this issue rates the bug as critical, but a core committer also indicated it was probably rare: the code had been released for 134 days before the first report, which implies that nearly all hosts already provide the DOM extension and that the critical flaw is not widespread.
Official announcement here.
Featured Image by Shutterstock/Yes058 Montree Nanta
