Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

beezle · 1790111081 · focus · HN ↗
"WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7"
As a courtesy, I try not to say more than one bad thing about WP every day. FWIW about 1/3 of installs are not on the recent 7 branch.
1. EGreg · 1790121013 · focus · HN ↗
  There was a time I looked up to Matt Mullenweg, but never to Wordpress.
  I've been building <a href="https://github.com/Qbix" rel="nofollow">https://github.com/Qbix since 2008 and let me tell ya, I took a lot of great ideas from Drupal, Kohana, Symfony, etc. But never Wordpress. It's just ... a mess. Wordpress just won by being first, basically. Kind of like Bitcoin.
  PS: Years ago, I hired a guy in Pakistan to work with me on some Wordpress sites, for clients. I thought that the Divi theme and basic Wordpress would be secure. Every one of those sites got pwned, badly. Sure, maybe it was the plugins. But why take the chance? In 2026 it's way past time to not have to worry about basic security.
  1. krapp · 1790121191 · focus · HN ↗
    Wordpress wasn't even first, Movable Type was the big thing before it.
    mgkimsal · 1790123827 · focus · HN ↗
    That was Perl though, wasn't it? mod_perl more specifically, IIRC. That alone relegated to a small pool of users.
    segfaultbuserr · 1790125261 · focus · HN ↗
    WordPress began as a FOSS replacement of Movable Type after Moving Type 3 made the controversial decision to change its licensing fee for some features. So it was like a Unix/Linux situation.
  2. pmlnr · 1790169164 · focus · HN ↗
    WP won by having a very simple but flexible admin page.
    Drupal admin was not for humans back then.
  3. tweetle_beetle · 1790175686 · focus · HN ↗
    A tale as old as time... I made money by outsourcing to third party labour to a much cheaper country than my own, using a third party low code theme builder and third party plugins I didn't vet. All of my customers got hacked.
    This is the problem WordPress faces - it's powerful enough for people to get stuff done on a shoestring. But the professionals who want to do things on a shoestring are also likely cutting corners elsewhere (hosting, backups, security, etc). In many cases there's money changing hands and it's easier to blame WordPress than poor decision making.
    I have more sympathy for those building with it on a shoestring for personal/charitable projects who may lack the skills/experience to follow <a href="https://developer.wordpress.org/advanced-administration/security/hardening/" rel="nofollow">https://developer.wordpress.org/advanced-administration/secu.... They're probably better off on Wix or Squarespace.
2. jeroenhd · 1790176583 · focus · HN ↗
  WordPress doesn't to LTS. WordPress usually backports security fixes to older branches (like the 6.x branches) but going all the way back to 4.x isn't something they'll do for every fix. Who knows how many bugs lie in wait for older versions that are out of support.
  If you run WordPress, you should be aware of this already. Either upgrade to the latest versions, constantly and quickly, or have extremely restrictive WAFs up and ready. Especially if you have any plugins installed (as those are usually where the WordPress exploits are coming from).
  I'd recommend everyone unhappy only finding out about WordPress' long-standing support policy to ask their money back.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.