Resolved WP Toolkit vulnerability alert might be a false positive? [Unauthenticated Blind SSRF]

[pascual]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

Plesk Obsidian 18.0.48

I have a question regarding a possible false positive in the WP Toolkit vulnerability alerts.

Last night we received alerts that all our WordPress installations are affected by a, supposedly newly discovered, security flaw.
This flaw is named as "WordPress <= 6.1.1 - Unauth. Blind SSRF vulnerability".

However after som digging it seems that there is a chance that this is a false positive, at least for those sites that have disabled XMLRPC and pingbacks. See the discussion over at the Wordpress support forum ("Site scan reports WP 6.1.1 vulnerability").

Anyone have any ideas on how to react to this or have any insights to share about the supposed vulnerability? We have a lot of hosted customers running Wordpress with WP Toolkit, and I expect a rush of customer support tickets regarding this warning today.

 

[custer]

Hi @pascual,

This is a low risk WordPress core vulnerability (info here), and there is no fix yet for this vulnerability in WordPress itself. I expect WordPress team to release a minor security update very soon.

Situation like this sucks for everyone around, so we are working on introducing virtual patches to WPT. They should be able to block vulnerabilities from being exploited even if an update with a fix isn't available yet.

 

[pascual]

Hi @pascual,

This is a low risk WordPress core vulnerability (info here), and there is no fix yet for this vulnerability in WordPress itself. I expect WordPress team to release a minor security update very soon.

Situation like this sucks for everyone around, so we are working on introducing virtual patches to WPT. They should be able to block vulnerabilities from being exploited even if an update with a fix isn't available yet.

Thank you so much!

 

[doncullen]

Jan 24 and WordPress still hasn't addressed the issue. May I suggest that WP-Toolkit be updated so it checks to confirm that Pingbacks/XML-RPC both are disabled, and if so, not report a threat. If either one are enabled, then by all means, yes, do report it as a threat until WordPress updates.

 

[Peter Debik]

@doncullen Plesk is aware of this and similar situations. For that reason we are working on introducing virtual patches in WP Toolkit. However, this is not an easy task and needs a lot of consideration and testing. It cannot be done on-the-fly. It would be Wordpress' responsibility to fix the issue in the first place. Until then we can only assist you with workarounds as described in

https://support.plesk.com/hc/en-us/articles/9109180378770-CVE-2022-3590-WordPress-6-1-1-Unauth-Blind-SSRF-vulnerability

 

[Wiz]

We get that the onus is on Wordpress to fix this but Plesk developed and is responsible for managing the extension - simplest thing they can do is add an alert mute/silence feature to silence the annoying visual and email alerts.

Really, it's that simple!