The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - An information disclosure vulnerability exists in the class-wp-press-this.php script due to a failure to properly restrict the user interface for assigning taxonomy terms. An authenticated, remote attacker can exploit this to disclose sensitive information. (CVE-2017-5610)

 - A SQL injection (SQLi) vulnerability exists in the class-wp-query.php script due to a failure to sanitize input to post type names. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data. (CVE-2017-5611)

 - A cross-site scripting (XSS) vulnerability exists in the class-wp-posts-list-table.php script due to improper validation of input to the posts list table. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-5612)

 - A privilege escalation vulnerability exists in the REST API due to a failure to properly sanitize user-supplied input to the 'id' parameter when editing or deleting blog posts. An unauthenticated, remote attacker can exploit this issue to run arbitrary PHP code, inject content into blog posts, modify blog post attributes, or delete blog posts. (CVE-2017-1001000)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The WordPress application running on the remote web server is version 4.7.x prior to 4.7.2. It is, therefore, affected by a privilege escalation vulnerability in the REST API due to a failure to properly sanitize user- supplied input to the 'id' parameter when editing or deleting blog posts. An unauthenticated, remote attacker can exploit this issue to run arbitrary PHP code, inject content into blog posts, modify blog post attributes, or delete blog posts.

The WordPress REST API is enabled by default as of version 4.7.0. This vulnerability was silently patched in WordPress version 4.7.2.

Note that WordPress is reportedly affected by additional vulnerabilities; however, the scanner has not tested for these.

The WordPress application running on the remote web server is version 4.7.x prior to 4.7.2. It is, therefore, affected by a privilege escalation vulnerability in the REST API due to a failure to properly sanitize user-supplied input to the 'id' parameter when editing or deleting blog posts. An unauthenticated, remote attacker can exploit this issue to run arbitrary PHP code, inject content into blog posts, modify blog post attributes, or delete blog posts.

The WordPress REST API is enabled by default as of version 4.7.0. This vulnerability was silently patched in WordPress version 4.7.2.

Note that WordPress is reportedly affected by additional vulnerabilities; however, Nessus has not tested for these.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.7.2.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     class-wp-press-this.php script due to a failure to     properly restrict the user interface for assigning     taxonomy terms. An authenticated, remote attacker can     exploit this to disclose sensitive information.
    (CVE-2017-5610)

  - A SQL injection (SQLi) vulnerability exists in the     class-wp-query.php script due to a failure to sanitize     input to post type names. An unauthenticated, remote     attacker can exploit this to inject or manipulate SQL     queries in the back-end database, resulting in the     disclosure or manipulation of arbitrary data.
    (CVE-2017-5611)

  - A cross-site scripting (XSS) vulnerability exists in the     class-wp-posts-list-table.php script due to improper     validation of input to the posts list table. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2017-5612)

  - A privilege escalation vulnerability exists in the REST     API due to a failure to properly sanitize user-supplied     input to the 'id' parameter when editing or deleting     blog posts. An unauthenticated, remote attacker can     exploit this issue to run arbitrary PHP code, inject     content into blog posts, modify blog post attributes, or     delete blog posts. (CVE-2017-1001000)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
98271	WordPress 3.7.x < 3.7.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98270	WordPress 3.8.x < 3.8.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98269	WordPress 3.9.x < 3.9.16 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98268	WordPress 4.0.x < 4.0.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98267	WordPress 4.1.x < 4.1.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98266	WordPress 4.2.x < 4.2.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98265	WordPress 4.3.x < 4.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98264	WordPress 4.4.x < 4.4.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98263	WordPress 4.5.x < 4.5.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98262	WordPress 4.6.x < 4.6.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98261	WordPress 4.7.x < 4.7.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98217	WordPress 4.7.x < 4.7.2 REST API 'id' Parameter Privilege Escalation	Web App Scanning	Component Vulnerability	high
97210	WordPress 4.7.x < 4.7.2 REST API 'id' Parameter Privilege Escalation	Nessus	CGI abuses	high
96906	WordPress < 4.7.2 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2017-1001000

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical