CVE-2019-17675
📋 TL;DR
This is a Cross-Site Request Forgery (CSRF) vulnerability in WordPress admin pages that occurs due to type confusion during referer validation. Attackers can trick authenticated administrators into performing unintended actions like changing settings, creating users, or installing plugins. All WordPress sites with versions before 5.2.4 are affected.
💻 Affected Systems
- WordPress
📦 What is this software?
Wordpress by Wordpress
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover through admin account compromise, allowing attackers to install malicious plugins/themes, create backdoor accounts, deface the site, or inject malware.
Likely Case
Unauthorized administrative actions such as changing site settings, creating new administrator accounts, or modifying content without the admin's knowledge.
If Mitigated
Limited impact with proper CSRF protections and admin awareness, though some administrative functions could still be exploited.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated admin users. Technical exploit details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WordPress 5.2.4 and later
Vendor Advisory: https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
Restart Required: No
Instructions:
1. Backup your WordPress site. 2. Update WordPress to version 5.2.4 or later via Dashboard > Updates. 3. Verify update completed successfully. 4. Test admin functionality.
🔧 Temporary Workarounds
CSRF Protection Plugin
allInstall and configure a WordPress security plugin that provides additional CSRF protection
Admin Session Management
allImplement strict admin session management: log out when not using admin panel, use separate browser for admin tasks
🧯 If You Can't Patch
- Implement web application firewall (WAF) with CSRF protection rules
- Restrict admin panel access to specific IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check WordPress version in Dashboard > Updates or via wp-includes/version.php fileCheck Version:
wp core version (if WP-CLI installed) or check wp-includes/version.phpVerify Fix Applied:
Confirm WordPress version is 5.2.4 or higher and test admin functions work normally📡 Detection & Monitoring
Log Indicators:
- Multiple admin actions from same session in rapid succession
- Admin actions with missing or malformed referer headers
- Unexpected user creation or privilege escalation
Network Indicators:
- HTTP requests to admin-ajax.php or admin-post.php with suspicious parameters
- Requests with missing or manipulated referer headers
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/*" OR uri_path="/wp-json/*") AND (referer="" OR NOT referer CONTAINS site_domain)🔗 References
- https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
- https://core.trac.wordpress.org/changeset/46477
- https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0
- https://lists.debian.org/debian-lts-announce/2019/11/msg00000.html
- https://seclists.org/bugtraq/2020/Jan/8
- https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
- https://wpvulndb.com/vulnerabilities/9913
- https://www.debian.org/security/2020/dsa-4599
- https://www.debian.org/security/2020/dsa-4677
- https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
- https://core.trac.wordpress.org/changeset/46477
- https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0
- https://lists.debian.org/debian-lts-announce/2019/11/msg00000.html
- https://seclists.org/bugtraq/2020/Jan/8
- https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
- https://wpvulndb.com/vulnerabilities/9913
- https://www.debian.org/security/2020/dsa-4599
- https://www.debian.org/security/2020/dsa-4677
