Pierluigi Paganini December 10, 2023

WordPress 6.4.2 addressed a security vulnerability that could be chained with another flaw to achieve remote code execution.

WordPress released a security update to address a flaw that can be chained with another issue to gain remote code execution.

According to the advisory, the RCE flaw is not directly exploitable in the core, however, threat actors can chain it with some plugins, especially in multisite installations, to execute arbitrary code.

“A Remote Code Execution vulnerability that is not directly exploitable in core; however, the security team feels that there is a potential for high severity when combined with some plugins, especially in multisite installations.” reads the advisory.

Researchers from WordPress cybersecurity firm Defiant labeled the issue as a POP chain introduced in version 6.4 that, combined with a separate Object Injection vulnerability, could result in a Critical-Severity vulnerability.

The issue resides in the WP_HTML_Token class, which was introduced in WordPress 6.4 to enhance HTML parsing in the block editor.

“It includes a __destruct magic method that is automatically executed after PHP has processed the request.” states Defiant. “Since an attacker able to exploit an Object Injection vulnerability would have full control over the on_destroy and bookmark_name properties, they can use this to execute arbitrary code on the site to easily gain full control. While WordPress Core currently does not have any known object injection vulnerabilities, they are rampant in other plugins and themes. The presence of an easy-to-exploit POP chain in WordPress core substantially increases the danger level of any Object Injection vulnerability.”

WordPress fixed the issue by adding a new method named “__wakeup” that blocks the execution of the vulnerable function.

Researchers recommend manually checking websites to ensure that they are updated.

“While most sites should automatically update to WordPress 6.4.2, we strongly recommend manually checking your site to ensure that it is updated.” concludes Defiant. “We recommend sharing this advisory with everyone you know who uses WordPress, as this is a potentially critical issue that could lead to complete site takeover.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, RCE)