WordPress Core 4.7.0-6.3.1 - Denial of Service via Cache Poisoning
Strategic Overview
4.7 – 6.3.1 · 17 branchesN/AVulnerability Overview
WordPress Core is vulnerable to Denial of Service via Cache Poisoning in versions between 4.7.0 and 6.3.1. In cases where the X-HTTP-Method-Override header was sent in a request to a REST endpoint and the endpoint returned a 4xx error, the error could be cached, resulting in denial of service.
Technical Analysis
REMEDIATION: Update to one of the following versions, or a newer patched version: 4.7.27, 4.8.23, 4.9.24, 5.0.20, 5.1.17, 5.2.19, 5.3.16, 5.4.14, 5.5.13, 5.6.12, 5.7.10, 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2 --- IDENTIFIER: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State) The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C