WordPress quickly patches second critical vulnerability

It's the second time in a week WordPress had fixed flaws involving malicious comments

WordPress patched a second critical vulnerability in its Web publishing platform on Monday, less than a week after fixing a similar problem.

Administrators are advised to upgrade to WordPress version 4.2.1. Some WordPress sites that are compatible with and use a plugin called Background Update Tester will update automatically.

WordPress is one of the most-used Web publishing platforms. By the company's own estimation, it runs 23 percent of the sites on the Internet, including major publishers such as Time and CNN.

The latest flaw was found by Jouko Pynnönen[cq] of Klikki Oy, a Finish software company. Pynnönen found WordPress was vulnerable to a cross-site scripting flaw if an attacker inserted malicious JavaScript into a comments field. The script runs when someone views the comment, according to an advisory.

Cross-site scripting flaws are among the most dangerous and common Web vulnerabilities, allowing rogue code to run that should be forbidden.

If a WordPress administrator is logged in when the malicious comment is viewed, the attacker can then execute arbitrary code on the server through the plugin and theme editors. It is also then possible to change the administrator's password, create new administrator accounts or manipulate content on a site. The vulnerability can't cause damage from an ordinary reader viewing the comment.

Klikki Oy alleged that WordPress had stopped communicating with it last November when Klikki found a different vulnerability in WordPress. With the latest flaw, Klikki said it had also tried to notify WordPress through the Finnish computer security authority, CERT-FI, and HackerOne, which offers a service for managing vulnerability reports and rewards.

On April 21, WordPress patched a vulnerability similar to the one Pynnönen came across. Cedric Van Bockhaven[cq] found that WordPress was vulnerable to a cross-site scripting attack involving comments due to a MySQL database behavior it allowed.

He found that rogue code could be executed when a person hovered over a malicious script inserted into a comments field. Proof-of-concept code written by Van Bockhaven showed how a new user could be added in the administration panel. The flaw could also be used to download a plugin that runs malicious server-side code, he wrote on his blog.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags securityWordpressExploits / vulnerabilitiesKlikki Oy

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?