1

Today, when I did some tests and found out that Wordpress doesn't filter the post_title.

Respectively, I make posts with the titles:

  1. <?php while ( have_posts() ) : the_post(); echo 'Post Title'; endwhile;?>
  2. <a href="http://stackexchange.com/">Post Title</a>
  3. <script type="text/javascript">alert('Post Title');</script>

I. With the first post, Wordpress puts entire title in html comment tag: <!--?php while ( have_posts() ) : the_post(); echo 'Post Title'; endwhile;?-->. Then no title shows up for this post.

II. The second, Wordpress return a title linked to http://stackexchange.com/.

III. The worst thing is the third one. A pop-up window with "Post Title" message appears three times. It's weird! What is Wordpress executing?

I made this test with Wordpress 4.2.2 on Twentyfiteen theme. I don't know much about security.

Does this bug(s) can be exploited and How do I filter it?

  • Anyone with Editor privileges and above can post unfiltered HTML or JS on Wordpress. – racec0ndition May 18 '15 at 14:00
2

Some general information:
While it might initially look like a bug this is not considered one.

There are certain roles in a WordPress site (like admins and editors) that have the ability to post unfiltered html to the website. This includes the post title which is the one you used here. This is not considered a bug since one can assume that the person that has admin privileges for the specific site can add or remove any content he wants anyway. See this link for further official information: http://codex.wordpress.org/FAQ_Security#Why_are_some_users_allowed_to_post_unfiltered_HTML.3F

You can think of it in a way that putting your above mentioned script block on your personal website would not be considered a bug either.

To answer your questions:
Wordpress will put the unfiltered html in the spot where the page title would be included. This will be a link if you chose your second input, a JavaScript script block (that will then be executed by your browser) if you chose the third one or basically any input you give it.

WordPress will however not interpret php code if it is posted there. It will only include the input as a string and modify the tags to resemble html comments.

However if all of this seems strange to you and you don't want administrators and editors to be able to post unfiltered html to your site you might want to add:

define( 'DISALLOW_UNFILTERED_HTML', true );

to your wp-config.php file (as described in the above mentioned link).

| improve this answer | |
1

Your first example is a demonstration that wordpress properly handles your PHP "injection" attempt: the code is escaped and not executed on the server.

Your second example is pretty straightforward: you place a link in a title, you get a link in the title. I'm not sure what you expected but it doesn't violate the basic constrain: someone - anyone - having the right to post an article - create content - can use a link. If that is not what you want, then perhaps wordpress isn't the tool for you.

The third example might be a little more delicate but it doesn't violate the basic premises of Wordpress security model either: you need to be an author (authenticated and with the proper authorization) to create a new article or edit an existing one. Therefore, only someone who already has the right to execute code in the context of the visiting users can use the article text to have javascript executed in the browser.

| improve this answer | |
  • Note re third example, as @Denis mentions, only admin/editor users have the unfiltered_html privilege by default - author users don't and the script tags will be stripped leaving just a non-executing alert('Post Title'); as the title. – bonger Oct 14 '15 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.