WordPress XSS2Shell Flaw Turns Simple Login Bug Into Full Server Takeover
Brief
WordPress XSS2Shell flaw enables admin takeover and remote code execution. Users should update to patched versions.
Researchers at Pwn just published a report on a vulnerability chain they’re calling XSS2Shell, and the entry point is quite simple: type a username that doesn’t exist, and WordPress echoes it back with a tiny formatting flaw baked into how two different sanitizers read the same string.
The bug lives in the login page’s error message. When someone submits a username that isn’t registered, WordPress builds an error using that submitted text, after running it through a function meant to strip out any HTML tags. That stripping function relies on PHP’s built-in strip_tags() , which only recognizes a tag if the opening bracket is immediately followed by a letter, no space in between.
That’s the whole crack in the wall.