CVE-2017-5610 (PHP, published 2017-01-30T04:59Z)
Description: value: wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/class-wp-press-this.php
wp-includes/version.php
Commit message: Press This: Do not show Categories & Tags UI for users who cannot assign terms to posts anyways.
Built from https://develop.svn.wordpress.org/trunk@39968


git-svn-id: http://core.svn.wordpress.org/trunk@39905 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
			'tax_input'     => ( ! empty( $_POST['tax_input'] ) ) ? $_POST['tax_input'] : array(),
			'post_category' => ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array(),
	 * @return string If not from a supported provider, an empty string. Otherwise, a reformattd embed URL.
				<button type="button" class="button-link post-option">
					<span class="dashicons dashicons-category"></span>
					<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
					<span class="dashicons post-option-forward"></span>
				</button>

				<button type="button" class="button-link post-option">
					<span class="dashicons dashicons-tag"></span>
					<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
					<span class="dashicons post-option-forward"></span>
				</button>
			<div class="setting-modal is-off-screen is-hidden">
				<button type="button" class="button-link modal-close">
					<span class="dashicons post-option-back"></span>
					<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
				</button>
				<?php $this->categories_html( $post ); ?>
			</div>
			<div class="setting-modal tags is-off-screen is-hidden">
				<button type="button" class="button-link modal-close">
					<span class="dashicons post-option-back"></span>
					<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
					<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
				</button>
				<?php $this->tags_html( $post ); ?>
			</div>
$wp_version = '4.8-alpha-39967';

Fixed code:
		// Only accept categories if the user actually can assign
		$category_tax = get_taxonomy( 'category' );
		if ( current_user_can( $category_tax->cap->assign_terms ) ) {
			$post_data['post_category'] = ( ! empty( $_POST['post_category'] ) ) ? $_POST['post_category'] : array();
		}

		// Only accept taxonomies if the user can actually assign
		if ( ! empty( $_POST['tax_input'] ) ) {
			$tax_input = $_POST['tax_input'];
			foreach ( $tax_input as $tax => $_ti ) {
				$tax_object = get_taxonomy( $tax );
				if ( ! $tax_object || ! current_user_can( $tax_object->cap->assign_terms ) ) {
					unset( $tax_input[ $tax ] );
				}
			}

			$post_data['tax_input'] = $tax_input;
		}

		// Toggle status to pending if user cannot actually publish
	 * @return string If not from a supported provider, an empty string. Otherwise, a reformatted embed URL.
		// Bail if user cannot assign terms
		if ( ! current_user_can( $taxonomy->cap->assign_terms ) ) {
			return;
		}

		// Only show "add" if user can edit terms
		$categories_tax   = get_taxonomy( 'category' );
		$show_categories  = current_user_can( $categories_tax->cap->assign_terms ) || current_user_can( $categories_tax->cap->edit_terms );

		$tag_tax          = get_taxonomy( 'post_tag' );
		$show_tags        = current_user_can( $tag_tax->cap->assign_terms );

				<?php if ( $show_categories ) : ?>
					<button type="button" class="button-link post-option">
						<span class="dashicons dashicons-category"></span>
						<span class="post-option-title"><?php _e( 'Categories' ); ?></span>
						<span class="dashicons post-option-forward"></span>
					</button>
				<?php endif; ?>

				<?php if ( $show_tags ) : ?>
					<button type="button" class="button-link post-option">
						<span class="dashicons dashicons-tag"></span>
						<span class="post-option-title"><?php _e( 'Tags' ); ?></span>
						<span class="dashicons post-option-forward"></span>
					</button>
				<?php endif; ?>
			<?php if ( $show_categories ) : ?>
				<div class="setting-modal is-off-screen is-hidden">
					<button type="button" class="button-link modal-close">
						<span class="dashicons post-option-back"></span>
						<span class="setting-title" aria-hidden="true"><?php _e( 'Categories' ); ?></span>
						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
					</button>
					<?php $this->categories_html( $post ); ?>
				</div>
			<?php endif; ?>
			<?php if ( $show_tags ) : ?>
				<div class="setting-modal tags is-off-screen is-hidden">
					<button type="button" class="button-link modal-close">
						<span class="dashicons post-option-back"></span>
						<span class="setting-title" aria-hidden="true"><?php _e( 'Tags' ); ?></span>
						<span class="screen-reader-text"><?php _e( 'Back to post options' ) ?></span>
					</button>
					<?php $this->tags_html( $post ); ?>
				</div>
			<?php endif; ?>
$wp_version = '4.8-alpha-39968';