How one flaw rewrote the content of 1.5 million WordPress pages
Imagine that someone on the other side of the world can visit your site and rewrite the content of any post, without a password, without an account, with a single request. Sounds like a movie? It really happened.
What happened
WordPress 4.7 introduced a new REST API, an interface through which applications "talk" to the site. There was a bug in its permission check (CVE-2017-1001000): a cleverly crafted address bypassed the check on who has the right to edit content. The result, anyone could overwrite any post or page.
The flaw affected versions 4.7.0 and 4.7.1. The WordPress team patched it quietly in 4.7.2, giving sites time to update. When the details came out, the avalanche began.
The scale
Within days automated bots defaced over 1.5 million pages across tens of thousands of sites. Instead of an offer or a blog, the signatures of "hacker" groups appeared. For a business this meant embarrassment in front of customers and a drop in Google.
What it teaches
Most importantly: the site was safe only until the core was updated. Whoever put off clicking "update" got hit.
- Enable automatic core updates for WordPress (minor releases install themselves anyway, do not block that).
- Make a backup before every major update.
- If you do not have time to keep on top of it, delegate it, flaws do not wait for a convenient moment.
This was not the fault of a "buggy plugin" or the user. It was the core of the most popular CMS in the world. That is why, as part of our care service, we update sites before a flaw becomes a headline, get in touch, we will check yours.
Source: NVD, CVE-2017-1001000.