Thread

1. system2 · 1790096284 · focus · HN ↗

   pearcmd.php must exist, and register_argc_argv must be on, not common with hosting providers. But I am assuming the other themes and meeting conditions possibly affect a lot of WordPress sites.

   1. dofm · 1790097375 · focus · HN ↗

      As the article points out, one issue is that the official Docker container for PHP has this configuration.

      However at least in principle all of the affected versions [0] could be automatically updated. Not sure if they have set it to auto-update as far back as 4.7 though.

      [0] except 4.9.3 which has a bug in its automatic update mechanism.

   2. foul · 1790097582 · focus · HN ↗

      pearcmd and register_argc_argv are just examples. get_page_template was unsanitized in some themes, that's the flaw, you could then combine it with one of a million unauthorized file upload in wordpress plugins to try and eval code. An attacker would like to use upload + this chain of requires (instead of just uploading a php) because of hardened configuration and the pwn can go unnoticed in the logs.

      Also, with pearcmd (if you can get to that, there's no open_basedir) and containers a novice sysadmin will publish insecure sites.

Unofficial Hacker News client; not affiliated with Y Combinator.