CVE-2019-17675: Cross-Site Request Forgery (CSRF) (CWE-352)
value: WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2019-10-17T13:15Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/pluggable.php, wp-includes/version.php
Commit date: 2019-10-14 15:40:04 +0000
Commit message: Administration: Ensure that admin referer nonce is valid.

Coding standards, ensure that nonce is valid with identical, rather then equal operator.

Props vortfu, xknown, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46477


git-svn-id: http://core.svn.wordpress.org/trunk@46275 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php
index 206761aaef9..fe6822d2105 100644
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -1104,11 +1104,11 @@ if ( ! function_exists( 'check_admin_referer' ) ) :
 	 * @param string     $query_arg Optional. Key to check for nonce in `$_REQUEST`. Default '_wpnonce'.
 	 * @return false|int False if the nonce is invalid, 1 if the nonce is valid and generated between
 	 *                   0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.
 	 */
 	function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {
-		if ( -1 == $action ) {
+		if ( -1 === $action ) {
 			_doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' );
 		}
 
 		$adminurl = strtolower( admin_url() );
 		$referer  = strtolower( wp_get_referer() );
@@ -1123,11 +1123,11 @@ if ( ! function_exists( 'check_admin_referer' ) ) :
 		 * @param false|int $result False if the nonce is invalid, 1 if the nonce is valid and generated between
 		 *                          0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago.
 		 */
 		do_action( 'check_admin_referer', $action, $result );
 
-		if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
+		if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) {
 			wp_nonce_ays( $action );
 			die();
 		}
 
 		return $result;
diff --git a/wp-includes/version.php b/wp-includes/version.php
index e53607b467a..76be1c0883c 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -11,11 +11,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-beta3-46476';
+$wp_version = '5.3-beta3-46477';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 		if ( -1 == $action ) {
		if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
$wp_version = '5.3-beta3-46476';
Fixed code: 		if ( -1 === $action ) {
		if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) {
$wp_version = '5.3-beta3-46477';