Vulnerability Disclosure: Wordpress 5.0.0 Remote Code Execution

On February 19th, RIPSTech disclosed two vulnerabilities in Wordpress core that can lead to remote code execution and potentially a full Wordpress account takeover. An attacker who can login to a Wordpress instance with the author permission can combine a directory traversal and local file inclusion vulnerability to execute arbitrary PHP code. The vulnerabilities were present in Wordpress Core for at least six years. The exploit was patched in versions 4.9.9 and 5.0.1, but not 5.0.0.

Recommendations

• Perform an update to Wordpress sites to versions that incorporate the patches (version 4.9.9 or 5.0.1).
• Audit Wordpress sites to ensure accounts with author access require that permission to perform needed functions.
• Routinely scan Wordpress plugins for security updates and patch accordingly.

Details

RIPSTech disclosed two vulnerabilities in Wordpress core that can give a user with the author permission the ability to execute arbitrary PHP code. When an image is uploaded to Wordpress core, a reference to the image is stored inside the wp_postmeta table. This table tracks meta information associated with the image in a key:value pair format. Users can update this metadata information, such as changing the description or updating the author. As a result, Wordpress core allowed users to input an arbitrary source image path within the metadata update function. This could allow attackers to specify a remote image URL to be downloaded onto the Wordpress instance.

The researchers also found a vulnerability (CVE-2019-6977) in libgd, which is one of two libraries used by Wordpress core to process images. If libgd is given an image with specifically crafted pixels, attackers can corrupt memory of the library to bypass image and mime-type verification to allow for malicious code to be sent in via the Wordpress upload function.