PT-2019-5224 · WordPress · Wordpress

Nguyen The Duc · Published 2019-09-11 · Updated 2023-01-20 · CVE-2019-20043

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions 3.7 through 5.3.0

Description The issue is related to an authentication error in the class-wp-rest-posts-controller function of the WordPress content management system, allowing users to mark posts as sticky via the REST API. This could be exploited by a remote attacker to impact data integrity. Authenticated users without the rights to publish a post, such as those with the contributor role, could bypass restrictions and mark posts as sticky or unsticky.

Recommendations For WordPress versions 3.7 through 5.3.0, update to version 5.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API endpoint related to post management until the update is applied.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-01953

CVE-2019-20043

DSA-4599-1

DSA-4677-1

GHSA-G7RG-HCHX-C2GW

Affected Products

Wordpress

References · 19

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20043 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-20043 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20043 · Vendor Advisory
• https://debian.org/security/2020/dsa-4599 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20043 · Vendor Advisory
• https://core.trac.wordpress.org/changeset/46893/trunk · Patch
• https://bdu.fstec.ru/vul/2020-01953 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-20043 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20043 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4599-1 · Vendor Advisory
• https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4677-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-20043 · Security Note
• https://debian.org/security/2020/dsa-4677 · Vendor Advisory
• https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9 · Note