CVE-2019-9787: Cross-Site Request Forgery (CSRF) (CWE-352)
value: WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2019-03-14T16:29Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/includes/ajax-actions.php, wp-includes/comment.php, wp-includes/version.php
Commit date: 2019-03-12 22:30:50 +0000
Commit message: Comments: Improve comment content filtering.
Built from https://develop.svn.wordpress.org/trunk@44842


git-svn-id: http://core.svn.wordpress.org/trunk@44674 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
index f273c4df6f3..86b205279e5 100644
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -1212,10 +1212,12 @@ function wp_ajax_replyto_comment( $action ) {
 			}
 
 			if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {
 		wp_die( __( 'Sorry, you must be logged in to reply to a comment.' ) );
 	}
diff --git a/wp-includes/comment.php b/wp-includes/comment.php
index 229330793ed..d245026d66a 100644
--- a/wp-includes/comment.php
+++ b/wp-includes/comment.php
@@ -3241,10 +3241,12 @@ function wp_handle_comment_submission( $comment_data ) {
 			if ( ! isset( $comment_data['_wp_unfiltered_html_comment'] )
 				|| ! wp_verify_nonce( $comment_data['_wp_unfiltered_html_comment'], 'unfiltered-html-comment_' . $comment_post_ID )
 			) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {
 		if ( get_option( 'comment_registration' ) ) {
 			return new WP_Error( 'not_logged_in', __( 'Sorry, you must be logged in to comment.' ), 403 );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index b004ec0b24b..ff6b8dfcedd 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -11,11 +11,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.2-alpha-44833';
+$wp_version = '5.2-alpha-44842';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '5.2-alpha-44833';
Fixed code: 				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
				add_filter( 'pre_comment_content', 'wp_filter_kses' );
				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
				add_filter( 'pre_comment_content', 'wp_filter_kses' );
$wp_version = '5.2-alpha-44842';