A user with the Author role or higher could upload a .txt file containing HTML markup and point the Interactivity API client-side router at it, for example through a link with a navigate directive. The router fetched the file and injected its markup into the current page as if it were an HTML page, regardless of the text/plain content type. Fixed in WordPress 7.1.4, which only fetches same-origin URLs and only processes successful same-origin text/html responses.
This vulnerability affects the following application versions:
- WordPress 6.5
- WordPress 6.5.2
- WordPress 6.5.3
- WordPress 6.5.4
- WordPress 6.5.5
- WordPress 6.5.6
- WordPress 6.5.7
- WordPress 6.5.8
- WordPress 6.5.9
- WordPress 6.5.10
- WordPress 6.5.11
- WordPress 6.5.12
- WordPress 6.5.13
- WordPress 6.6
- WordPress 6.6.1
- WordPress 6.6.2
- WordPress 6.6.3
- WordPress 6.6.4
- WordPress 6.6.5
- WordPress 6.6.6
- WordPress 6.6.7
- WordPress 6.6.8
- WordPress 6.6.9
- WordPress 6.6.10
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.7.5
- WordPress 6.7.6
- WordPress 6.7.7
- WordPress 6.7.8
- WordPress 6.7.9
- WordPress 6.7.10
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.8.6
- WordPress 6.8.7
- WordPress 6.8.8
- WordPress 6.8.9
- WordPress 6.8.10
- WordPress 6.8.11
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 6.9.8
- WordPress 6.9.9
- WordPress 6.9.10
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.0.5
- WordPress 7.0.6
- WordPress 7.0.7
- WordPress 7.1
- WordPress 7.1.1
- WordPress 7.1.2
- WordPress 7.1.3