Summary
An unauthenticated XML-RPC pingback request can make a WordPress server fetch an attacker-controlled URL. The supplied chain analysis combines that server-side request with an incomplete special-use IP-range check and a DNS-resolution time-of-check/time-of-use gap. On a cloud-hosted deployment this can expose internal metadata services; IAM-credential theft depends on the cloud provider, metadata mode, instance role, and a usable response-exfiltration path.
Affected Products
WordPress core. The readable chain package documents the behavior against WordPress 7.0.3. The August 12 disclosure email states that the findings were revalidated against WordPress 7.0.4, but that revalidation trace is not present in the readable chain artifact; exact 7.0.4 status remains for vendor confirmation.
Affected Scope
- Product
- WordPress
- Component
- XML-RPC pingback and HTTP URL validation
- Affected function
- WP_XMLRPC_Server::pingback_ping(); wp_safe_remote_get(); wp_http_validate_url()
- Affected versions
- WordPress 7.0.3 per the readable chain package; the August 12 disclosure states 7.0.4 revalidation, which is not independently traceable from that artifact
- Safe version
- Not established in the supplied chain artifact
- CWE
- CWE-918
Technical Summary
Unauthenticated attacker-controlled sourceURI reaches a server-side HTTP fetch. Incomplete special-use IP filtering plus DNS-resolution TOCTOU can expose internal services and, under cloud-specific prerequisites, metadata credentials.
Prerequisites and Permissions
XML-RPC and pingbacks must be enabled; the target post must accept the pingback flow; the server must be able to make outbound HTTP requests on the allowed ports. No authentication is required for the chain entry. Metadata credential impact additionally requires a reachable cloud metadata service, suitable metadata mode, and an attached role.
Affected Locations
wp-includes/class-wp-xmlrpc-server.php:6914 — WP_XMLRPC_Server::pingback_ping(); attacker-controlled sourceURI / $pagelinkedfrom. wp-includes/http.php:559 — wp_http_validate_url(); special-use IPv4 range checks around the reported validator block. wp-includes/class-wp-http.php / transport layer — final DNS resolution and connection behavior relevant to the reported validation-versus-fetch TOCTOU. Default allowed ports identified in the report: 80, 443, and 8080.
Reproducible Proof
Bounded proof from the supplied report: an anonymous POST /xmlrpc.php pingback.ping with sourceURI directed to a controlled listener caused the WordPress server to issue an outbound GET, identified by the listener log. The report also records validator acceptance for 169.254.169.254, 169.254.170.2, and 100.64.1.1, plus distinct fault-code behavior for reachable and unreachable internal hosts. Full metadata paths, credential extraction, rebinding timing, and exploit automation are intentionally omitted.
Vulnerable Code
class="tok-string">```php
$request = wp_safe_remote_get( $pagelinkedfrom, $http_api_args );
$remote_source = wp_remote_retrieve_body( $request );
class="tok-string">```
class="tok-string">```php
if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
|| ( 192 === $parts[0] && 168 === $parts[1] )
) {
class="tok-comment">// If host appears local, reject unless specifically allowed.
}
class="tok-string">```Severity
high
Technical Analysis
The chain begins in WP_XMLRPC_Server::pingback_ping(), where the sourceURI is fetched server-side to verify a link. The supplied report identifies the following actual code path:
$request = wp_safe_remote_get( $pagelinkedfrom, $http_api_args ); $remote_source = wp_remote_retrieve_body( $request );
The same report identifies wp_http_validate_url() as the shared guard and quotes its IPv4 checks as allowing the 169.254.0.0/16 and 100.64.0.0/10 ranges in the assessed source. It also records a validation-time DNS lookup followed by an independent connection-time resolution, so a rebinding name can pass the first decision and resolve elsewhere at connect time. This advisory records the bounded chain; the full metadata retrieval and rebinding sequence is withheld.
Impact
Confidentiality: High, conditionally. The chain can read internal HTTP responses and, on an affected cloud configuration such as IMDSv1 with an attached role, may expose temporary cloud credentials. Integrity: Not demonstrated by the supplied chain. Availability: Not demonstrated. The cloud-account-compromise outcome is configuration-dependent and should not be read as universal impact on every WordPress deployment.
Remediation
Reject all IPv4 and IPv6 special-use, loopback, link-local, private, multicast, reserved, and metadata ranges using inet_pton()-based CIDR checks. Revalidate the resolved destination immediately before connecting and after every redirect hop, preventing DNS-rebinding changes between validation and fetch. Remove pingback.ping from the enabled XML-RPC method set by default or require an explicit safe configuration. Add regression tests for 169.254.169.254, 169.254.170.2, 100.64.0.0/10, IPv6 equivalents, redirects, and rebinding.
Timeline
- Published
- Advisory published
Credits
Aria Akhavan / Haikhavan Security