WordPress v6.4.2 wrongly detected as v6.4.1 resulting in a false positive alert

[andrei-a-papou]

Subject of the issue

WordPress v6.4.2 wrongly detected as v6.4.1 resulting in a false positive alert and failing tests.

Your environment

• Version of WPScan: 3.8.25
• Operating System (OS): Debian 11.8

Steps to reproduce

Run a scan against fully updated WordPress v6.4.2.

Expected behavior

No vulnerabilities should be reported against WordPress core.

Actual behavior

We get a false positive, namely the "WP 6.4-6.4.1 - POP Chain" vulnerability:

"vulnerabilities": [
      {
        "title": "WP 6.4-6.4.1 - POP Chain",
        "fixed_in": "6.4.2",
        "references": {
          "url": [
            "https://fenrisk.com/publications/blogpost/2023/11/22/gadgets-chain-in-wordpress/"
          ],
          "wpvulndb": [
            "2afcb141-c93c-4244-bde4-bf5c9759e8a3"
          ]
        }
      }
    ]

Version detection seems to happen by testing a checksum of a CSS file:

"version": {
    "number": "6.4.1",
    "release_date": "2023-11-09",
    "status": "insecure",
    "found_by": "Unique Fingerprinting (Aggressive Detection)",
    "confidence": 100,
    "interesting_entries": [
      "https://example.com/wp-admin/css/list-tables.css md5sum is 8cbb07fe1bb99aab41572598178101f8"
    ],

[erwanlr]

Whoops, we forgot to push the new fingerprints, it's done now and you can get them with wpscan --update then scan again

[andrei-a-papou]

Thanks, works now