WordPress XSS vulnerability -what you should know

[tangor]

A newly revealed vuln in the open-source CMS WordPress allows an unauthenticated website attacker to remotely execute code – potentially letting naughty folk delete or edit blog posts.

The flaw, detailed by German code-checking company RIPS Technologies in a blog post, can be exploited "by tricking an administrator of a target blog to visit a website set up by the attacker" in order to activate a cross-site request forgery exploit.

[theregister.co.uk...]
As always, be up to date and current on installs and patches!

[not2easy]

That's good to know, but there isn't anything to patch, the article warns of an exploit not likely to affect security conscious admins:

The attack relies on a) the target site having comments enabled, and b) the site admin being oblivious enough to click a dodgy link, however the attacker presents it to them. Security-aware folk are unlikely to be affected by this.

[tangor]

Or ... as the article continues:

To avoid this rather convoluted vuln, WordPress admins should ensure their installs are patched to version 5.1.1, or, failing that, disable comments until the core site can be patched.

Agreed that admins might cause the problem ... but having the latest install would obviate that.

YMMV