WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation.

Simon Scannell of Ripstech Technologies discovered multiple vulnerabilities in wordpress, a web blogging manager.

CVE-2019-8942

remote code execution in wordpress because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata.

CVE-2019-9787

wordpress does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration.
This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access.

For Debian 8 'Jessie', these problems have been fixed in version 4.1.26+dfsg-1+deb8u1.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the detected WordPress application is affected by a cross-site scripting (XSS) vulnerability due to insufficient input sanitization in comment.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the WordPress application running on the remote web server is affected by multiple vulnerabilities:

  - A cross-site request forgery (XSRF) vulnerability     exists in the comment form due to improper validation. A     remote attacker can exploit this by tricking a user into     visiting a specially crafted web page, allowing the     attacker to create comments on the administrator's     behalf. (CVE-2019-9787)

  - A cross-site scripting (XSS) vulnerability exists due     to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote     attacker can exploit this, by convincing a user to     click a specially crafted URL, to execute arbitrary     script code in a user's browser session.

ID	Name	Product	Family	Severity
136373	Debian DSA-4677-1 : wordpress - security update	Nessus	Debian Local Security Checks	critical
123529	Debian DLA-1742-1 : wordpress security update	Nessus	Debian Local Security Checks	high
98392	WordPress 5.1.x < 5.1.1 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98391	WordPress 5.0.x < 5.0.4 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98390	WordPress 4.9.x < 4.9.10 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98389	WordPress 4.8.x < 4.8.9 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98388	WordPress 4.7.x < 4.7.13 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98387	WordPress 4.6.x < 4.6.14 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98386	WordPress 4.5.x < 4.5.17 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98385	WordPress 4.4.x < 4.4.18 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98384	WordPress 4.3.x < 4.3.19 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98249	WordPress 4.2.x < 4.2.23 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98248	WordPress 4.1.x < 4.1.26 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98247	WordPress 4.0.x < 4.0.26 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
98246	WordPress 3.9.x < 3.9.27 Cross-Site Scripting	Web App Scanning	Component Vulnerability	high
122823	WordPress < 5.1.1 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2019-9787

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high