------------------------------------------------------------------------ Path traversal vulnerability in WordPress Core Ajax handlers ------------------------------------------------------------------------ Yorick Koster, July 2016
------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ A path traversal vulnerability was found in the Core Ajax handlers of the WordPress Admin API. This issue can (potentially) be used by an authenticated user (Subscriber) to create a denial of service condition of an affected WordPress site. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160712-0036 ------------------------------------------------------------------------ See also ------------------------------------------------------------------------ #37490 - Improve capability checks in wp_ajax_update_plugin() and wp_ajax_delete_plugin() ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on the WordPress version 4.5.3. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ WordPress version 4.6 mitigates this vulnerability by moving the CSRF check to the top of the affected method(s). ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html ------------------------------------------------------------------------ Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.
