WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal
WordPress 7.1.1 patches 11 core vulnerabilities, including stored XSS in wpautop() and an authenticated path traversal in the REST Templates Controller reported by Anthropic.
WordPress released 7.1.1, a short-cycle maintenance and security update fixing 11 vulnerabilities across core, themes, REST API, comments, XML-RPC, and plugin management, plus 17 core and 19 Block Editor bug fixes. The most notable flaw is a stored XSS in wpautop() where unauthenticated commenters can inject script that executes when a moderator approves the comment, potentially enabling admin session theft. Anthropic reported an authenticated path traversal in the WP REST Templates Controller and an authorization flaw letting low-privileged users overwrite posts outside their scope. Security fixes are backported to supported branches through WordPress 4.7, and WordPress 7.2 is expected in December.
- Stored XSS in wpautop() lets unauthenticated commenters inject script that executes when moderators approve comments.
- Authenticated path traversal in WP REST Templates Controller and a post-overwrite authorization flaw were reported by Anthropic.
- Other fixes cover XML-RPC customize_changeset publishing bypass, private post title disclosure, and comment reparenting by any authenticated user.
- Security fixes are backported to supported branches through WordPress 4.7; automatic updates apply the patch.
Full article579 words · extracted from gbhackers.com · click to collapse
WordPress has released version 7.1.1, a maintenance and security update that addresses 11 vulnerabilities affecting core platform components, themes, REST API functionality, comments, XML-RPC, and plugin management.
Site administrators are strongly urged to update immediately due to the potential impacts of stored cross-site scripting, authenticated path traversal, authorization bypasses, and information disclosure flaws.
This release also includes 17 core bug fixes and 19 fixes for the Block Editor. While WordPress 7.1.1 is a short-cycle maintenance release, WordPress 7.2 is expected to arrive in December.
WordPress 7.1.1 Fixes 11 Security Flaws
One of the most notable issues addressed is a stored cross-site scripting (XSS) vulnerability in the wpautop() function. This flaw could allow an unauthenticated visitor to inject malicious script content through comments, provided that a site moderator subsequently approves the submitted comment.
Stored XSS vulnerabilities can be especially dangerous for WordPress sites because malicious JavaScript may execute in the browsers of administrators, editors, or visitors viewing the affected content.
Depending on the targeted user’s privileges, successful exploitation could lead to session theft, unauthorized administrative actions, content manipulation, or redirects to attacker-controlled pages.
The update also addresses a stored XSS vulnerability affecting certain themes that support custom headers. WordPress also fixed an HTML API issue where the set_modifiable_text() function could allow an attacker to escape an HTML comment through abrupt-closing sequences.
Another issue involved specially crafted URLs that could automatically install and preview an inactive theme from WordPress.org. Although the advisory did not disclose full exploitation details, the fix eliminates an unexpected theme-management pathway that could be exploited in targeted attacks.
WordPress 7.1.1 resolves an authenticated path traversal vulnerability in the WP REST Templates Controller, which Anthropic reported. Path traversal weaknesses can enable attackers to manipulate file paths using sequences like ../, potentially gaining access to unintended files or directories when application controls are insufficient.
Anthropic also reported a flaw that lets lower-privileged authenticated users overwrite posts outside their intended authorization scope, posing a risk to editorial integrity on multi-author websites.
Other authorization-related fixes include a vulnerability that allowed XML-RPC requests to publish customize_changeset posts while bypassing checks for the edit_css capability. WordPress has also fixed an issue that allowed site administrators to network-activate an installed network-only plugin.
The update fixes a missing read_post permission check in the attachment_submitbox_metadata() function. This flaw could expose the title of a private parent post through attachment metadata.
Additionally, WordPress addressed a missing authorization check that could disclose draft or pending post slugs to users with Contributor-level privileges and above. While these post slugs may seem low-risk, they can reveal planned articles, campaign names, product announcements, or sensitive editorial information.
Separately, an issue allowed any authenticated user to reparent comments, including internal notes. This could impact moderation workflows and potentially expose or misplace discussion context.
Administrators can download WordPress 7.1.1 from WordPress.org or install it through the dashboard by navigating to Updates and selecting “Update Now.” Sites configured for automatic background updates should receive the patch automatically.
WordPress has stated that security fixes are also being backported to supported legacy branches through version 4.7, where necessary. Site owners should verify their deployed version, review administrative accounts, and ensure that plugins and themes are updated alongside the core installation.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/wordpress-7-1-1-fixes-11-security-flaws/