CVE-2017-1001000
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 84.9%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 84.94% probability · 100th percentile
- CISA KEV
- Not listed
- Affected
- wordpress/wordpress
- Source
- 46fe6300-5254-4a98-9594-a9567bec8179
References
- http://www.openwall.com/lists/oss-security/2017/02/10/16
- http://www.securitytracker.com/id/1037731
- https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
- https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html
- https://codex.wordpress.org/Version_4.7.2
- https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab
- https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7
- https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/
- https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
- http://www.openwall.com/lists/oss-security/2017/02/10/16
- http://www.securitytracker.com/id/1037731
- https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
- https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html
- https://codex.wordpress.org/Version_4.7.2
- https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab
- https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7
- https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/
- https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.