Description
WordPress is prone to same origin method execution (SOME) vulnerability. The impact of a SOME attack is similar to the impact of cross-site scripting, though there are some important and distinguishing exploitation restrictions. An attacker may leverage this issue to hijack dangerous web functionality and even exfiltrate sensitive user data. WordPress versions 4.4.x ranging from 4.4 and up to (and including) 4.4.2 are vulnerable.
Remediation
Update to WordPress version 4.4.3 or latest
References
https://gist.github.com/cure53/09a81530a44f6b8173f545accc9ed07e
https://hackerone.com/reports/134738
http://www.benhayak.com/2015/06/same-origin-method-execution-some.html
Related Vulnerabilities
Opencart Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-47444)
Drupal Core 5.x Multiple Cross-Site Request Forgery Vulnerabilities (5.0 - 5.1)
Perl Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-2827)
Envoy Proxy Improper Encoding or Escaping of Output Vulnerability (CVE-2023-35941)
WordPress Plugin Multisite Global Search 'mssearch' Parameter Cross-Site Scripting (1.2.5)