WordPress 2.0.5 Trackback Vulnerability with Exploit

Find your website's Achilles' Heel


WordPress was “born out of a desire for an elegant, well-architectured personal publishing system built on PHP and MySQL and licensed under the GPL. It is the official successor of b2/cafelog. WordPress is fresh software, but its roots and development go back to 2001. It is a mature and stable product. We hope by focusing on user experience and web standards we can create a tool different from anything else out there.”

While testing WordPress it was discovered that WordPress supports trackbacks in different charsets when PHP’s mbstring extension is installed. This feature can be abused to bypass WordPress’s SQL parameter escaping which leads to an SQL injection vulnerability that can result in a compromise of the admin account and end in a server compromise.

Full details of the vulnerability here.

An exploit is available here.

A work-around is available if something is stopping you from upgrading. WordPress 2.0.6 has fixed this problem.

Open wp-trackback.php and comment the following lines, this will prevent anyone from changing the default charset from the ‘safe’ ones to the ‘unsafe’ ones (UTF-7 to name one):

It is recommended to upgrade to WordPress 2.0.6 ASAP though.


Posted in: Exploits/Vulnerabilities, Web Hacking

, , , , ,

Recent in Exploits/Vulnerabilities:
- Intel Hidden Management Engine – x86 Security Risk?
- TeamViewer Hacked? It Certainly Looks Like It
- Serious ImageMagick Zero-Day Vulnerabilities – ImageTragick?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,746 views
- AJAX: Is your application secure enough? - 120,098 views
- eEye Launches 0-Day Exploit Tracker - 85,537 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Trackbacks/Pingbacks

  1. Wordpress 2.0.7 Follows Hot on the Tail of Wordpress 2.0.6 » - January 17, 2007

    […] Recently a bug in certain versions of PHP came to the attention of the WordPress developers, this bug could cause a security vulnerability in your any blogs running version 2.0.6 or below blog. It was fairly easy to work around, so they decided to release 2.0.7, just 10 days after the release of 2.0.6, to fix the PHP security problem and the Feedburner issue that was in 2.0.6. It is recommended that everyone running WordPress 2.0.6 or lower upgrade to this new version. […]