Summary
WordPress Interactivity API style binding: Style binding value and safe-style allowlist exhibits the validated behavior described in this advisory. The public record is intentionally bounded and does not include a turnkey exploit.
Affected Products
WordPress core
Affected Scope
- Product
- WordPress
- Component
- WordPress Interactivity API style binding
- Affected function
- Style binding value and safe-style allowlist
- Affected versions
- WordPress 7.0.4 and earlier versions in the tested line
- Safe version
- No fixed version supplied; vendor remediation status unknown
- CWE
- CWE-20
Technical Summary
A style binding value bypasses the server-side safe-style list and reaches the rendered output. The public description omits a reusable injection payload. This was reproduced in the tested WordPress line; reusable payload details are withheld.
Prerequisites and Permissions
Authenticated user able to create or edit the affected block content.
Affected Locations
Affected path: Style binding value and safe-style allowlist. Exact source line was not stated in the supplied report and is not invented here.
Reproducible Proof
A controlled test using the documented preconditions reproduced the stated behavior. The full PoC, payload, and automation are withheld.
Vulnerable Code
$style_value = wp_interactivity_process_directive( $value, $context );
$element->set_attribute( &class="tok-comment">#39;style', $style_value );Severity
medium
Technical Analysis
A style binding value bypasses the server-side safe-style list and reaches the rendered output. The public description omits a reusable injection payload.
Impact
The demonstrated impact is limited to the documented authorization, disclosure, integrity, or availability effect. No broader impact is claimed.
Remediation
Apply authorization and input/resource bounds at the affected Style binding value and safe-style allowlist path, preserve the intended privilege boundary, and add regression coverage for the demonstrated condition.
Timeline
- Published
- Advisory published
Credits
Reported by Aria Akhavan.