I recently scanned my Wordpress site using 6scan's security scanning service. It reported a high severity vulnerability: "Wordpress comment posting forgery".

Technical details from 6scan:

  • The 6scan report says "CSRF vulnerability in allows malicious users to make fake posts". It says the affected URL is /wp-comments-post.php.

  • When I click the 6scan report's link for more technical details, it directs me to this page, which is a generic page that refers to zero-day vulnerabilities (i.e., vulnerabilities disclosed to the Wordpress team but not publicly known). However, that page hasn't been updated since July 17, 2012 (almost a year ago), and it has no specific mention of this CSRF vulnerability.

  • The 6scan report also suggests a way to manually fix the problem: it suggests manually editing wp-comments-post.php to add some code that basically checks to make sure $_SERVER[ "HTTP_REFERER" ] matches $_SERVER[ "HTTP_HOST" ].

I am running Wordpress 3.5.1 (currently the most recent version). Is Wordpress really vulnerable to a "comment posting forgery" vulnerability? Or is the 6scan report bogus?

I know that older versions of Wordpress had some CSRF vulnerabilities, but I believe those have been fixed. Personally, I find the claim of a vulnerability pretty dubious -- but I thought I would check with others.


This is a false alarm. Many “Security Programs” do that. That’s called FUD.

WordPress does not check the Referer header, because it is often empty, and real spammers send the site URL as Referer anyway.

But all comment field are sanitized, so no harmful code will be injected. Install an anti-spam plugin, and everything is fine. This report is obviously bogus.

  • Thanks. This sounds like what I am looking for. However, my one hesitation is: sanitizing comment fields is not enough to prevent CSRF attacks. If there is indeed a CSRF vulnerability in comment posting, an anti-spam plugin is not the right solution; the right solution is to fix the CSRF vulnerability. So, I'm still left wondering whether there is indeed a CSRF vulnerability in Wordpress or not. – D.W. Jun 4 '13 at 15:32
  • 1
    @D.W. If there is an unknown vulnerability, we wouldn’t know it. If there is a known vulnerability, it would be fixed already. There are many problems with WordPress, but security bugs are fixed amazingly fast. – fuxia Jun 4 '13 at 16:07
  • Good point, toscho. Thank you for the words of wisdom and sensible advice! – D.W. Jun 4 '13 at 19:23

You should always have Akismet activated. It will catch 99.99% of spam comments.

  • This does not answer the question. – fuxia Jun 4 '13 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.