WordPress metaWeblog.editPost Post Arbitrary Modification (xmlrpc, Exploit, Patch)
2 Feb. 2008
Summary
WordPress is "a state-of-the-art semantic personal publishing platform with a focus on aesthetics, web standards, and usability". A vulnerability in the way Wordpress handles the metaWeblog.editPost allows remote attackers that have just subscriber privileges to modify the posts of other users.
Credit:
The information has been provided by Paul (Yabba) Jones.
Workaround:
To prevent the xmlrpc engine from modifying posts without verifying whether the person has rights to do so or not modify the following PHP code:
if ( ('post' == $post_type ) && !current_user_can('edit_post', $post_ID) )
return new IXR_Error(401, __('Sorry, you can not edit this post.'));
To include:
if ( (1 || 'post' == $post_type ) && !current_user_can('edit_post', $post_ID) )
return new IXR_Error(401, __('Sorry, you can not edit this post.'));
Of course the patch is not official, and would probably break other stuff - but security is our number one priority, as a side note version 2.0.x doesn't have that 'post' == ... test.
