Steven J. Murdoch has discovered a weakness in WordPress, which can be exploited by malicious people to bypass certain security restrictions.

The weakness is caused due to the fact that it is possible to construct the two authentication cookies ("wordpressuser_*" and "wordpresspass_*") from the data in the "users" table.

Successful exploitation allows e.g. logging in as administrator, but requires read access to the "users" table of the database.

NOTE: The weakness is reportedly being exploited in the wild.

The weakness is confirmed in version 2.3.1 and reported in all previous versions down to and including 1.5.

Solution
Grant only trusted users read access to the "users" table.
Further details available in Customer Area

Provided and/or discovered by
Reported as an 0-day.

Also reported by Steven J. Murdoch.

Changelog
Further details available in Customer Area

Original Advisory
http://www.cl.cam.ac.uk/~sjm217/advisories/wordpress-cookie-auth.txt

Deep Links
Links available in Customer Area