There is a new Wordpress exploit in wp-includes/formatting.php

$textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE);

General problem here is that they try to parse HTML using regular expression. If they had ever looked at Stackoverflow they would know it's a bad idea.

Anyway, I tried to figure out how it works to understand the problem. I could not find a working solution, but I was able to create get script>:

preg_split("/(<.*>|\[.*\])/Us", "<<<>script>e", -1, PREG_SPLIT_DELIM_CAPTURE);

See https://xrg.es/#17aydc5

How could you create a full <script> tag?

1 Answer 1


You might need to re-read the advisory, the important part is this:

A text containing carefully mixed square and angle brackets confuses the splitting process and results in HTML code getting partially texturized.

An attacker can exploit the bug to supply any attributes in the allowed HTML tags. A style attribute can be used to create a transparent tag covering the whole window, forcing the execution of its onmouseover handler.

The exploit is injecting a onmouseover attribute by mixing the square and angle brackets. It is likely that you cannot inject a scipt tag at all. And since the injected text requires partial texturisaiton you will not see the actual output with your regex url. It will only let you determine which chunks are sent to be texturized. In order to see the rendered output you would need a vulnerable version of wordpress to inject into,

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .