WordPress 5.0.1 Security Release – Immediate Update Recommended
WordPress 5.0.1 was released Wednesday night, less than a week after the much anticipated release of WordPress 5.0. This security release fixes seven security vulnerabilities, a few of which are quite serious.
Sites running versions in the 4.x branch of WordPress core are also impacted by some of the issues. WordPress 4.9.9 was released along with 5.0.1 to address the issues for those users.
We have not seen attempts to exploit these vulnerabilities in the wild yet, but given the number of sites impacted we expect that to change.
The speed at which these security issues were discovered, reported and fixed is a testament to the strength of the WordPress community working together.
Sensitive Data Exposure
Team Yoast discovered that the user activation screen could be indexed by search engines in some uncommon configurations, leading to exposure of email addresses, and in some rare cases, default generated passwords. WordPress has addressed this by stripping the activation key used in the URL, and storing the value in a cookie instead.
PHP Object Injection
Sam Thomas discovered that contributors could craft meta data in a way that resulted in PHP object injection. This looks to be similar to the 2 arbitrary file delete vulnerabilities fixed in WordPress 4.9.6. This vulnerability allows an author to assign an arbitrary file path to an attachment. The file path supplied by the author uses the phar:// stream wrapper on a previously uploaded attachment which leads to object injection utilizing a “feature” of the PHAR file type which stores serialized objects in the metadata of the PHAR file. Sam Thomas presented this technique at BlackHat earlier this year.
Unauthorized Post Creation
Simon Scannell of RIPS Technologies discovered that authors could create posts of unauthorized post types with specially crafted input. The requirement that an attacker would need at least ‘author’ level privileges makes the likelihood of this being exploited on a widespread basis very low.
Privilege Escalation / XSS
Tim Coen discovered that contributors could edit new comments from higher-privileged users, potentially leading to a cross-site scripting vulnerability. This is another vulnerability that requires a higher-level user role, making the likelihood of widespread exploitation quite low. WordPress addressed this issue by removing the <form> tag from their HTML whitelist.
Tim Coen and Slavco discovered that users with ‘author’ privileges on Apache-hosted sites could upload specifically crafted files that bypass MIME verification, leading to a cross-site scripting vulnerability. Yet again, the ‘author’ level user requirement makes an unlikely target for attackers.
XSS That Could Impact Some Plugins
Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances. The code change in WordPress core affects the wpmu_admin_do_redirect function which is not used in WordPress, but a plugin may call this function somewhere.
Unauthorized File Deletion
Karim El Oeurghemmi discovered that author-level users could alter metadata to delete files that they weren’t authorized to. This issue stems from the 2 arbitrary file delete vulnerabilities fixed in WordPress 4.9.6. The fix in WordPress addressed how attachment files are deleted, by restricting the file paths to the uploads directory, but did not address the issue of authors having the ability to change the attachment paths to arbitrary files. An author can use this to delete other users’ attachments.
What To Do
We have released firewall rules to protect our Premium customers against the vulnerabilities most likely to be exploited. Sites running the free version of Wordfence will receive them in 30 days.
Sites on WordPress 5.0 should update to version 5.0.1 as soon as possible. Those with automatic updates enabled for WordPress core should have already been updated, but given the nature of the vulnerabilities we recommend you check your sites manually just in case.
Sites running WordPress 4.x versions should update to version 4.9.9 as soon as possible. We’ve heard conflicting reports about automatic updates working for this upgrade. If you need to manually upgrade, the 4.9.9 update can be downloaded here.
You can find the official release announcement from the WordPress team here.
You kind of wish they would test these things better before sending them out for everyone to update. We are getting killed with spam because Contact Form 7 is forcing an update to reCaptcha V3, which is not working.
One of my sites had all of the plugins set back to inactive during the update. I appreciate Wordfence and the security features as it is not easy to keep your site safe in the age we live in.
Yeah the Contact Form 7 plugin update forcing reCaptcha V3 caught me out on a few sites as well. It just reinforces to me that you have to do these sorts of updates on a 'minor' site first to see what's going to break, before going ahead on a mission critical site :-)
thank you so much..
It's nice that Wordfence provide mails with news about security releases. Often it's hard no notice every update, since WordPress releases them quite often
Thanks for informing us. I appreciate Wordfence and the security features
I don't see this critical update, the last update I see was from Dec 4. ver 7.1.18
Hi Eric! This article refers to a WordPress core update, not an update to our Wordfence plugin.
Thanks for the updates, these are really useful. I am so grateful to use the Wordfence plugin and receive these updates as it really does give me peace of mind. Thank you
We've not updated to WP 5.0.1, and on our site, we still have 4.9.8. Not sure if we need to upgrade to 4.9.9. Now, does this make sense? - We would prefer not to use the Gutenberg Editor for a while, and wonder whether we need to install the classic editor plugin first, before going ahead with any of the WP core updates. Can you advise on this?
Hi Michela, if you want to stay on the 4.x branch of WordPress for now you can update to 4.9.9 to receive the security fixes that were included in 5.0.1.
Thanks. That was my question too!
Thank you, Dan for the reply.