A security researcher named “Anthony Ferrara” has found a critical SQL Injection (SQLI) vulnerability in the WordPress CMS. According to WordPress team, the vulnerability exists in all previous versions of the CMS, Whereas the vulnerability has been patched in the latest WordPress version 4.8.3 released which was released yesterday. Therefore, WordPress has strongly encouraged all it’s CMS users to upgrade their scripts to the latest version as soon as possible.
WordPress reported that the issue comes from $wpdb->prepare(), which can create unexpected and unsafe queries leading to an SQL Injection (SQLI). WordPress team have said that the vulnerability is not in the core script, but can be caused by plugins and themes using $wpdb->prepare(). WordPress had been made changes to the esc_sql() function to prevent SQL Injection queries, However the changes wont have any effects on WordPress developers.
The vulnerability founder, Anthony Ferrara shared a story on his blog on how he got WordPress team to pay attention to the bug reported. Although WordPress had literally ignored the bug, thinking it wasn’t a vulnerability. After Anthony Ferrara asked permission for disclosing the vulnerability to the public, WordPress team decided to have another look into the reported vulnerability, which then was found to be a serious flaw.
The vulnerability was originally found on 19th September 2017, which then was reported to WordPress on 20th September 2017. On 27 October 2017, Anthony Ferrara shared a tweet on Facebook regarding him disclosing the SQL Injection vulnerability in WordPress soon.
IMPORTANT: I will be disclosing a massive WP SQLi vulnerability soon. I have no confidence WP will fix correctly and hence no choice but FD
— Anthony Ferrara (@ircmaxell) October 26, 2017
That being said, On 31st October 2017, Anthony Ferrara published an article on his blog on how the vulnerability works, what code causes the CMS to break and how to fix the buggy code in steps. WordPress also thanked Anthony Ferrara for reporting the vulnerability and for practicing responsible disclosure.
Back in February, WordPress was vulnerable to a REST API exploit which had lead to thousands of websites being hacked and defaced. As the new SQL Injection vulnerability has just been disclosed to the public, we hope it won’t result in the same outcome as it did with the REST API vulnerability.