JVN#56787058: WordPress plugin "WP Job Manager" fails to restrict access permissions

The WordPress plugin "WP Job Manager" provided by Automattic Inc. fails to restrict access permissions. Impact A remote unauthenticated attacker may upload an image file to the server. Solution Update the plugin Update the plugin according to the information provided by the developer. According t...

Automattic: Timing attack woocommerce, simplify commerce gateway

file class-wc-gateway-simplify-commerce.php method returnhandler e.g. where woocommerce marks the order regarding its payment / transaction. public function returnhandler @obclean; header 'HTTP/1.1 200 OK' ; if isset $REQUEST'reference' && isset $REQUEST'paymentId' && isset $REQUEST'signature'...

Automattic: An Automattic employee's GitHub personal access token exposed in Travis CI build logs

An employee's GitHub OAuth token was inadvertently exposed in the Travis CI build logs of an Automattic project. This token has since been revoked. Please see https://blog.travis-ci.com/2017-05-08-security-advisory for more information...

Automattic: Wordpress.com REST API oauth bypass via Cross Site Flashing

Hello Automattic Security Team, There is a vulnerability in https://public-api.wordpress.com/crossdomain.xml. This file allows .yahoo.com and .yimg.com to perform cross domain requests to https://public-api.wordpress.com. However, these domains are vulnerable to Cross-Site flashing. An attacker c...

Automattic: Follow Button XSS

PoC 1 Open link 2 Click "Follow" in the bottom right-hand corner XSS Should work on any wordpress site with this Follow button. fbd.isLoggedIn must be equal to false. https://apps.wordpress.com/support/"scriptalertdocument.domain/script https://labs.spotify.com/"scriptalertdocument.domain/script...

Automattic: Persistent Cross-Site Scripting in WooCommerce WordPress plugin

Hello, I've discovered a persistent Cross-Site Scripting vulnerability in the WooCommerce. Yesterday I created a support ticket on the website, but today someone told me about the bug bounty program, so here we go. The vulnerability was discovered during a month long security project to find...

Security Alert: WordPress Forum plug-in bbPress, there is stored XSS vulnerability, the impact of fix version 2. 5. 9 all previous versions-bug warning-the black bar safety net

Recently, the WordPress parent company Automattic released bbPress 2.5.9 version in the official WordPress Forum plugin to the latest version, fixes a higher threat of the storage typeXSSvulnerabilities that affect the scope include existing bbPress version, i.e., version 2.5.9 of all will suffer...

Automattic: XSS at wordpress.com

1 Using Firefox, visit the link: https://wordpress.com/themes/filter/blog/type/%22%3E%3Cimg%20src=a%20onerror=alert%28document.domain%29%3E 2 alert is shown. Screenshot is attached...

Automattic: Internal GET SSRF via CSRF with Press This scan feature

Description ----------------------------------- The url http://xxx.xxx.xxx.xxx/wp-admin/press-this.php?u=URLTOSCRAPE&url-scan-submit=Scan does not validate that user intends to send a scrape request. The filter does not validate for 0.0.0.0:PORT and allows the attacker to make the victim send GET...

Automattic: Possible Timing Side-Channel in XMLRPC Verification

https://github.com/Automattic/jetpack/blob/bc7a4541ef6f0e9f583376d801ab0c40cfb976c3/class.jetpack-xmlrpc-server.phpL115 I mentioned this to @daljo628 and he suggested submitting it here instead. This looks very much like a classic timing attack vulnerability. The fix would be to use hashequals...

Automattic: XSS on codex.wordpress.org

Proof-of-concept here - http://codex.wordpress.org/thumb.php?f=xss%23%3Cbody%09onload=confirm%28String.fromCharCode%2888,83,83%29%29%3E...

Automattic: Remove anyone's pic gravtar

Hi, There is no csrf token while removing image Attacker can Delete Victim's Gravtar Image Just by sending Link Poc: https://en.gravatar.com/emails/remove-userimage/youemailimageid here Thanks :...

WordPress Fixes Stored XSS Vulnerability in Akismet

Developers at Automattic, the parent company behind the blogging platform WordPress, fixed a nasty stored cross-site scripting error this week in Akismet, an anti-spam plugin that figures into millions of websites. The bug was fixed Tuesday in an update, 3.1.5, according to Christopher Finke, an...

Automattic: XSS in WordPress

Hi there , I have identified a WordPress security vulnerability , a potential XSS vulnerability that affects latest version of WordPress . POC :- Go to GET .wordpress.com/wp-admin/post-new.php In Text HTML Field input , Now, Click on Visual Tab , XSS will trigger . Screenshot attached Thanks and...

WordPress WP Super Cache Plugin Security Vulnerability Patch

A persistent cross-site scripting XSS vulnerability exists in some versions of a popular WordPress caching engine plugin. The issue – since fixed – exposes vulnerable sites to takeover. From there, attackers could inject malicious scripts, backdoors and so forth. The plugin, WP Super Cache, has...

Automattic: Open Redirect in WordPress Feed Statistics {Affected All Versions}

Hi, Feed Statistics Plugin is vulnerable to Open Redirect and effecting large amount of Websites. Which is the reason it should be patched swiftly. Detail description is given below: Tested on: Wordpress 3.9.1 Vulnerable Plugin: Feed Statistics Plugin Link:...

Automattic: User Enumeration and Guessable User Account Attack on WORDPRESS

Hello, I found another bug on https://wordpress.com. Here any hacker can find out all registered users on wordpress.com. Here are the details of the same. How is wordpress.com is working? ============================ 1. You have Reset Password Page --...

Automattic: Serving Transitions From: HTTP Protocol (not secure)

Dear Sir, I've Noticed from your SourceCode that you are using HTTP Protocol, and that will makes Insecure served for data transition. we will give the attacker a chance for "MIMT" man in the middle attack as you know that the name of the attack itself explain the steps. -check the source code of...

Automattic: genericons.com - DOM based XSS.

Hi, I found a DOM based XSS located here : http://genericons.com/bold" Best regards, Olivier Beg...

Automattic: http://jetpack.me/ Self XSS

Hi there : I found a self XSS located at the front page of http://jetpack.me/, To reproduce this you have to scroll to the Every feature! part and search for in the search engine. Best regards, Olivier Beg...