PT-2019-5538 · WordPress · Wordpress

Published 2019-03-14 · Updated 2020-05-06 · CVE-2019-9787

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.1.1

Description The issue is related to improper filtering of comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs due to mishandled CSRF protection and incorrect Search Engine Optimization of A elements, resulting in XSS. The XSS allows administrative access, enabling arbitrary changes to .php files. The wp ajax replyto comment function in ajax-actions.php and the wp handle comment submission function in comment.php are specifically affected. Exploitation of the issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For WordPress versions prior to 5.1.1, update to version 5.1.1 or later to resolve the issue. As a temporary workaround, consider disabling the wp ajax replyto comment function and restricting access to the wp handle comment submission function in comment.php to minimize the risk of exploitation. Additionally, restrict access to the wp-admin/includes/ajax-actions.php and wp-includes/comment.php files to prevent unauthorized changes.

Exploit

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2020-03934

CVE-2019-9787

DLA-1742-1

DSA-4677-1

Affected Products

Wordpress

References · 19

• 🔥 https://github.com/sijiahi/Wordpress_cve-2019-9787_defense · Exploit
• 🔥 https://blog.ripstech.com/2019/wordpress-csrf-to-rce · Exploit
• https://github.com/WordPress/WordPress/commit/0292de60ec78c5a44956765189403654fe4d080b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-9787 · Security Note
• https://ubuntu.com/security/CVE-2019-9787 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9787 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9787 · Vendor Advisory
• https://wordpress.org/support/wordpress-version/version-5-1-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-9787 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-9787 · Security Note
• https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4677-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1742-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03934 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-9787 · Vendor Advisory