WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload

2026-03-10 00:00
Youssef Achtatal

Strategic Overview

Status
Patched in 6.8.4
Affected Core
WordPress 6.9
Affected Version
6.8 – 6.9.1 · 2 branches
CVSS
6.5Medium
Weakness type
CWE-611 · Improper Restriction of XML External Entity Reference
CVE
CVE pending
View all WordPress 6.9 vulnerabilities

At a glance

This record tracks a medium-severity Improper Restriction of XML External Entity Reference vulnerability in the WordPress 6.9 WordPress release line, affecting 6.8 – 6.9.1 · 2 branches. It carries a CVSS score of 6.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires an authenticated account at Author level or above. The issue is fixed in version 6.8.4; sites on affected versions should update now. Disclosed March 2026, reported by Youssef Achtatal.

Vulnerability Overview

WordPress core is vulnerable to XML External Entity (XXE) Injection via the bundled getID3 library in all versions up to and including 6.9.1. This is due to the `GETID3_LIBXML_OPTIONS` constant including the `LIBXML_NOENT` flag, which enables XML entity substitution during parsing. When WordPress processes media files containing XML metadata (specifically iXML chunks in WAV/RIFF/AVI files), the getID3 library parses the XML with entity substitution enabled, allowing local file disclosure via `file://` protocol URIs. This may make it possible for authenticated attackers with Author-level access to read arbitrary files from the server.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

CWE-611: Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Remediation

Update to one of the following versions, or a newer patched version: 6.8.4, 6.9.2

How does WordSec protect against this?

An attacker needs Author access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: updating to 6.8.4 is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7b7474-c170-42a2-be88-0fe410a2e71b

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C