AIKIDO-2025-10043

johnpbloch/wordpress-core is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes

Improperly Controlled Modification of Dynamically-Determined Object Attributes Pre-CVE Published Jan 27, 2025

Medium Risk

This Affects:

johnpbloch/wordpress-core

1.0.0 - 3.7.37

Fixed in 3.7.38

3.8.0 - 3.8.37

Fixed in 3.8.38

3.9.0 - 3.9.35

Fixed in 3.9.36

4.0.0 - 4.0.34

Fixed in 4.0.35

4.1.0 - 4.1.34

Fixed in 4.1.35

4.2.0 - 4.2.31

Fixed in 4.2.32

4.3.0 - 4.3.27

Fixed in 4.3.28

4.4.0 - 4.4.26

Fixed in 4.4.27

4.5.0 - 4.5.25

Fixed in 4.5.26

4.6.0 - 4.6.22

Fixed in 4.6.23

4.7.0 - 4.7.22

Fixed in 4.7.23

4.8.0 - 4.8.18

Fixed in 4.8.19

4.9.0 - 4.9.19

Fixed in 4.9.20

5.0.0 - 5.0.15

Fixed in 5.0.16

5.1.0 - 5.1.12

Fixed in 5.1.13

5.2.0 - 5.2.14

Fixed in 5.2.15

5.3.0 - 5.3.11

Fixed in 5.3.12

5.4.0 - 5.4.9

Fixed in 5.4.10

5.5.0 - 5.5.8

Fixed in 5.5.9

5.6.0 - 5.6.7

Fixed in 5.6.8

5.7.0 - 5.7.5

Fixed in 5.7.6

5.8.0 - 5.8.3

Fixed in 5.8.4

5.9.0 - 5.9.1

Fixed in 5.9.2

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to improperly controlled modification of dynamically determined object attributes through the block editor. This occurs because the block editor fails to properly restrict or validate dynamically assigned object attributes. An attacker can exploit this vulnerability to manipulate the object prototype, potentially injecting malicious scripts. This can lead to unauthorized access, data modification, or disruption of application behavior, posing significant security risks.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

johnpbloch/wordpress-core is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in versions 1.0.0 - 3.7.37, 3.8.0 - 3.8.37, 3.9.0 - 3.9.35, 4.0.0 - 4.0.34, 4.1.0 - 4.1.34, 4.2.0 - 4.2.31, 4.3.0 - 4.3.27, 4.4.0 - 4.4.26, 4.5.0 - 4.5.25, 4.6.0 - 4.6.22, 4.7.0 - 4.7.22, 4.8.0 - 4.8.18, 4.9.0 - 4.9.19, 5.0.0 - 5.0.15, 5.1.0 - 5.1.12, 5.2.0 - 5.2.14, 5.3.0 - 5.3.11, 5.4.0 - 5.4.9, 5.5.0 - 5.5.8, 5.6.0 - 5.6.7, 5.7.0 - 5.7.5, 5.8.0 - 5.8.3 and 5.9.0 - 5.9.1.