I recently scanned my Wordpress site using 6scan's security scanning service. It reported a high severity vulnerability: "Wordpress comment posting forgery".
Technical details from 6scan:
The 6scan report says "CSRF vulnerability in allows malicious users to make fake posts". It says the affected URL is /wp-comments-post.php.
When I click the 6scan report's link for more technical details, it directs me to this page, which is a generic page that refers to zero-day vulnerabilities (i.e., vulnerabilities disclosed to the Wordpress team but not publicly known). However, that page hasn't been updated since July 17, 2012 (almost a year ago), and it has no specific mention of this CSRF vulnerability.
The 6scan report also suggests a way to manually fix the problem: it suggests manually editing wp-comments-post.php to add some code that basically checks to make sure
$_SERVER[ "HTTP_REFERER" ]matches
$_SERVER[ "HTTP_HOST" ].
I am running Wordpress 3.5.1 (currently the most recent version). Is Wordpress really vulnerable to a "comment posting forgery" vulnerability? Or is the 6scan report bogus?
I know that older versions of Wordpress had some CSRF vulnerabilities, but I believe those have been fixed. Personally, I find the claim of a vulnerability pretty dubious -- but I thought I would check with others.