Add to Google Reader, Bloglines, Netvibes

A Cross-site scripting (XSS) vulnerability has been in found in wp-admin/template.php which could allow malicious web users to inject arbitary web scripts or HTML code through the file parameter.

This exploit could allow remote attackers to do nasty things by injecting php or html codes into your wordpress core files.

Vulnerable versions of Wordpress:

  • WordPress, 2.0.5
  • WordPress, 2.0.4
  • WordPress, 2.0.3
  • WordPress, 2.0.2
  • WordPress, 2.0.1
  • WordPress, 2.0
  • WordPress, 1.5.
  • WordPress, 1.5.1.3
  • WordPress, 1.5.1.2
  • WordPress, 1.5.1
  • WordPress, 1.5
  • WordPress, 1.2.2
  • WordPress, 1.2.1
  • WordPress, 1.2
  • WordPress, 0.71
  • WordPress, 0.7
  • Wordpress, (B2) 0.6.2.1
  • Wordpress, (B2) 0.6.2

The simplest way to fix this exploit would be to download the patched version of template.php and then replace it with your exiting wp-admin/template.php

Read more about this exploit on Operation N or Security Focus

Wordpress is a powerful blogging script, I’m sure lots of you might be blogging using Wordpress. Don’t wait any longer, go patch your template.php file now.

Thanks for the tip Ashish, Phalgun



17 Comments and Trackbacks (Add Your Own)

Pages: [1] 2 3 »

  1. Thanks Thilak to add my name.

  2. Thanks for the update!

    Is there any problem if we didnt replace the file?

  3. [...] To learn more about this vulnerability, visit Operation N or Security Focus. Report via Tech-Buzz. [...]

  4. Rishi: No, there won’t be a problem unless you are spotted by some attacker

  5. Thilak,

    What concerns me the most is that Wordpress.org hasn’t released anything about this yet. There isn’t anything posted on their blog and no official fixes. What more do you know about this and do you think that Wordpress.org knows about this?

  6. Security Alert: templates.php XSS vulnerability in WordPress

    Thanks to Thilak of TechBuzz, I’ve just learned about wp-admin/templates.php (part of your WordPress administration functionality) seems to be vulnerable to a rather nasty XSS exploit.

  7. You mean existing… not exiting ;)

Pages: [1] 2 3 »

Leave a Reply

Grab our RSS feed.

Updates straight to your inbox.