WordPress this week released a security update for the popular content management system (CMS) to address a remote code execution (RCE) vulnerability.
The flaw addressed in the open source CMS is a property oriented programming (POP) chain issue introduced in WordPress core 6.4. It can be combined with a different object injection flaw, allowing attackers to execute PHP code on vulnerable websites.
The bug was identified in a class that was introduced in WordPress 6.4 to improve HTML parsing in the block editor, the Wordfence team at WordPress security company Defiant explains.
The vulnerable class includes a function that is executed automatically after PHP has processed a request, and which uses properties that an attacker may have full control of.
“While WordPress Core currently does not have any known object injection vulnerabilities, they are rampant in other plugins and themes. The presence of an easy-to-exploit POP chain in WordPress core substantially increases the danger level of any Object Injection vulnerability,” Wordfence explains.
In its advisory, WordPress notes that the RCE flaw is not exploitable directly in core, but that, when combined with some plugins, it may pose a high risk.
To resolve the issue, WordPress added a new method that prevents the vulnerable function from executing, thus preventing exploitation.
The RCE bug was patched in WordPress 6.4.2. Site owners and administrators are advised to update to the fixed CMS version as soon as possible.
While there are no indicators that the vulnerability is being exploited in malicious attacks, bugs in WordPress and associated plugins have long been an attractive target for threat actors.
“While most sites should automatically update to WordPress 6.4.2, we strongly recommend manually checking your site to ensure that it is updated,” Wordfence notes.
Related: Backdoor Malware Found on WordPress Website Disguised as Legitimate Plugin
Related: Recently Patched TagDiv Plugin Flaw Exploited to Hack Thousands of WordPress Sites
Related: Vulnerability in WordPress Migration Plugin Exposes Websites to Attacks
Related: Critical WordPress Plugin Vulnerabilities Impact Thousands of Sites
