WordPress silently fixes dangerous code injection vulnerability

Developers of the widely used WordPress content management system released an update last week, but intentionally delayed announcing that the patch addressed a severe vulnerability.

WordPress version 4.7.2 was released on January 26 as a security update, but the accompanying release notes only mentioned fixes for three moderate risk vulnerabilities, one of which did not even affect the platform’s core code.

On Wednesday, a week later, the WordPress security team disclosed that a fourth vulnerability, much more serious than the others, was also patched in version 4.7.2.

The vulnerability was discovered by researchers from web security firm Sucuri and was reported privately to the WordPress team on January 20. It’s located in the platform’s REST API (application programming interface) and allows unauthenticated attackers to modify the content of any post or page within a WordPress site.

“We believe transparency is in the public’s best interest,” WordPress core developer Aaron Campbell said in a blog post Wednesday. “It is our stance that security issues should always be disclosed. In this case, we intentionally delayed disclosing this issue by one week to ensure the safety of millions of additional WordPress sites.”

According to Campbell, after learning about the flaw, the WordPress developers reached out to security companies that maintain popular web application firewalls (WAFs) so they can deploy protection rules against possible exploits. They then contacted large WordPress hosting companies and advised them on how to implement protections for their customers before an official patch was released.

The vulnerability only affects WordPress 4.7 and 4.7.1, where the REST API is enabled by default. Older versions are not affected, even if they have the REST API plug-in.

“We’d also like to thank the WAFs and hosts who worked closely with us to add additional protections and monitored their systems for attempts to use this exploit in the wild,” Campbell said. “As of today, to our knowledge, there have been no attempts to exploit this vulnerability in the wild.”

While that’s good news, it doesn’t mean that attackers won’t start exploiting this vulnerability now that the information is out. WordPress is the most popular website building platform, which makes it a very attractive target for hackers.

Webmasters should make sure that they update their WordPress sites to version 4.7.2 as soon as possible if they haven’t done it yet.