Anonymous trackback content insertion and author/URL spoofing

Summary

The trackback endpoint accepts attacker-controlled author, URL and content fields without a reliable authenticity boundary, allowing anonymous comment insertion and spoofing.

Affected Products

WordPress core 7.0.4; wp-trackback.php.

Affected Scope

Product

WordPress

Component

Trackback endpoint and comment creation

Affected function

wp-trackback.php; tb_id; title; excerpt; url; wp_new_comment()

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-862; CWE-20

Technical Summary

The endpoint accepts anonymous trackback fields and passes them into comment creation without a reliable sender-authentication boundary.

Prerequisites and Permissions

Unauthenticated access to wp-trackback.php for a post with trackbacks/comments enabled.

Affected Locations

wp-trackback.php: tb_id/post lookup, title/excerpt/url parsing and wp_new_comment() call; comment fields.

Reproducible Proof

A controlled anonymous request created a comment showing the supplied marker author/URL/content on an eligible test post. Spam automation and payloads are withheld.

Vulnerable Code

$inserted = wp_insert_comment([
    &class="tok-comment">#39;comment_post_ID' => $postId,
    &class="tok-comment">#39;comment_authorclass="tok-string">' => (string) ($_POST['blog_nameclass="tok-string">'] ?? ''),
    &class="tok-comment">#39;comment_author_urlclass="tok-string">' => (string) ($_POST['urlclass="tok-string">'] ?? ''),
    &class="tok-comment">#39;comment_contentclass="tok-string">' => (string) ($_POST['excerptclass="tok-string">'] ?? ''),
    &class="tok-comment">#39;comment_typeclass="tok-string">' => 'trackback',
    &class="tok-comment">#39;comment_approvedclass="tok-string">' => '1',
]);

Severity

low

Technical Analysis

wp-trackback.php parses tb_id, title, excerpt, url and source metadata, then reaches comment creation without a nonce or email verification. The resulting comment can present attacker-selected author/URL/content values when comments are open.

Impact

Integrity impact: unauthenticated users can add spoofed trackback/comment content to eligible posts. The report does not claim arbitrary comments on closed posts or stored XSS.

Remediation

Require authenticated/verified trackback origin or strong abuse controls, validate and rate-limit fields, and ensure comments_open/status checks are enforced consistently.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.