Microsoft Vulnerability Research Advisory MSVR11-010

Microsoft is providing notification of the discovery and remediation of a vulnerability affecting WordPress version 3.1.2 and earlier, both as the cloud service from WordPress.com as well as the installable software available from WordPress.org. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, WordPress. WordPress has remediated the vulnerability.

A vulnerability exists in the way that WordPress previously implemented protection against cross site scripting and content-type validation. An attacker could exploit this vulnerability to achieve script execution.

Microsoft Vulnerability Research reported this issue to and coordinated with WordPress to ensure remediation of this issue. For information on this issue from WordPress, please see WordPress News: WordPress 3.1.3 (and WordPress3.2 Beta 2)

• An attacker who successfully exploited this vulnerability could execute scripts on other parties' WordPress blogs in the same domain. In order for this attack to be successful all targets require an active and authenticated session with the target blog.

Purpose of Advisory: To notify users of a vulnerability and its remediation.

Advisory Status: Advisory published.

Recommendation: Review the Suggested Actions section and configure as appropriate.

For more information about this issue, see the following references:

This advisory discusses the following software.

Microsoft thanks the following:

• Richard Lundeen and Jesse Ou of Microsoft for discovering this issue and the team at WordPress for working toward a resolution.

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

• V1.0 (August 16, 2011): Advisory published.