Remote HTTP Request Vulnerability in Google Spellchecker for WordPress
Summary
CVE-2012-6112: classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other... Affects wordpress versions < 3.5.1+dfsg-2. Fixed in 3.5.1+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Google Spellchecker is an addon for TinyMCE, widely used in various applications including Moodle and WordPress. It provides spell-checking functionality to enhance user experience while editing text. However, prior versions of this addon are susceptible to a vulnerability that allows remote attackers to exploit control characters in input strings, leading to arbitrary outbound HTTP requests.
Vulnerability Detail
The vulnerability, identified as CVE-2012-6112, originates from the improper handling of control characters in the GoogleSpell.php file of the PHP Spellchecker addon. This flaw can be exploited by remote attackers who craft specific input strings that trigger unintended HTTP requests, potentially leading to data leakage or further attacks on the network. The affected versions include those prior to 2.0.6.1 for TinyMCE, impacting Moodle versions 2.1.x, 2.2.x, 2.3.x, and 2.4.x.
How To Fix
Minimum fixed version
3.5.1+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wordpressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider disabling the Google Spellchecker addon temporarily to mitigate the risk until the system can be updated.
Conclusion
CVE-2012-6112 presents a significant risk to applications using the Google Spellchecker addon for TinyMCE, particularly in WordPress environments. Users are strongly advised to upgrade to the latest version to protect against potential exploitation. For those unable to upgrade immediately, disabling the addon serves as a temporary workaround.
See every vulnerability recorded for wordpress →
FAQ
CVE-2012-6112 is a vulnerability in the Google Spellchecker addon for TinyMCE that allows remote attackers to send arbitrary HTTP requests due to improper handling of control characters.
WordPress versions prior to 3.5.1+dfsg-2 in Debian ecosystems are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized outbound HTTP requests, which may result in data leakage or further attacks on the network.
Yes, temporarily disabling the Google Spellchecker addon can help mitigate the risk until an upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
