If you’re a WordPress.com user you’ll want to be extra cautious the next time you’re tempted to whip up a blog post from your local coffee shop. If anyone on the same open connection is using a networking sniffing tool like Firesheep, your WordPress.com account could be easily hacked.
That’s the recent discovery revealed by Yan Zhu, a staff technologist at the Electronic Frontier Foundation who works on the HTTPS Everywhere and Privacy Badger extensions. Writing on her personal blog (and first reported by Ars Technica), Zhu noticed that WordPress.com was sending a login confirmation cookie to the user’s browser unencrypted.
The cookie, called “wordpress_logged_in,” is what WordPress.com uses to determine whether a user is logged in or not. If the cookie is set, then WordPress won’t bother to ask you for your login credentials again until the cookie expires.
It’s a common feature that almost every major online service uses so that you don’t have to constantly enter your username and password every time you return to a site. But because WordPress.com sends the cookie in plain text, it can be easily grabbed by a hacker if you login over an open Wi-Fi network.
Once a hacker has the login confirmation cookie, the bad actor can hijack a user’s account to publish blog posts, create new blog sites, view private posts and blog stats, and even post comments to other blogs as the hijacked user.
Zhu also said the cookie can be used repeatedly even if the original user logs out of their account. Ideally, a login cookie would expire and become unusable once a user logs out.
A “wordpress_logged_in” cookie from WordPress.com set to expire in 2017.
Surprisingly, WordPress.com login confirmation cookies are valid for three years. It’s not clear if the website would invalidate the cookie before then, but sufficed to say an attacker could have access to a hijacked account for an extended period of time.
Good news…and more bad news
The good news is that a hacker can’t reset a user’s password with the login confirmation cookie, but the bad news is they could still lock a user out of their account. Like many other sites, WordPress.com supports two-factor authentication, and Zhu discovered that an attacker could set-up two-factor authentication on a hijacked account if it wasn’t already in place.
Once activated, two-factor authentication requires you to submit a one-time passcode after entering your username and password to enter your account. The one-time codes can be generated by a smartphone application or be sent via SMS. The problem in this scenario is that the hijacked user wouldn’t have access to those codes, but the hacker would, since it was the bad guy that set-up the feature in the first place.
Although Zhu discovered the problem on WordPress.com, the problem also affects self-hosted WordPress blogs that use the open source version of the software. On self-hosted versions, however, the login confirmation cookie expires after two weeks and not three years. Self-hosted sites using HTTPS encryption should be safe, however.
WordPress.org developer Andrew Nacin told Zhu via Twitter that this vulnerability will be fixed for self-hosted blogs during the next WordPress release. But it’s not clear when Automattic might release a fix for WordPress.com. We’ve dropped the company a line to find out and will update this story should Automattic company respond.
UPDATE 05/28: Automattic says it is currently working on a fix and will be providing more information soon via the company’s blog.