WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection

2026-08-08 00:00
Anonymous

Strategic Overview

Status
Patched in 4.7.34
Affected Core
WordPress 7.0
Affected Version
4.7.0 – 7.0.2 · 24 branches
CVSS
5.5Medium
Weakness type
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE
CVE pending
View all WordPress 7.0 vulnerabilities

At a glance

This record tracks a medium-severity Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the WordPress 7.0 WordPress release line, affecting 4.7.0 – 7.0.2 · 24 branches. It carries a CVSS score of 5.5 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Author level or above. The issue is fixed in version 4.7.34; sites on affected versions should update now. Disclosed August 2026.

Vulnerability Overview

WordPress Core is vulnerable to CSS Injection in all versions up to, and including, 7.0.2 due to insufficient sanitization of user supplied CSS. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary CSS into posts, altering the appearance and content of pages rendered for other users.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Remediation

Update to one of the following versions, or a newer patched version: 4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

How does WordSec protect against this?

An attacker needs Author access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: updating to 4.7.34 is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/c83a2c4d-a264-49ec-85f1-e3f48715d725

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C