diff --git a/lib/common/models/wp_version/findable.rb b/lib/common/models/wp_version/findable.rb
index a771ff22..43a1fb1b 100644
--- a/lib/common/models/wp_version/findable.rb
+++ b/lib/common/models/wp_version/findable.rb
@@ -168,11 +168,14 @@ class WpVersion < WpItem
#
# @return [ String ] The version number
def find_from_readme(target_uri)
- scan_url(
+ version = scan_url(
target_uri,
%r{ \sversion #{version_pattern}}i,
'readme.html'
)
+
+ # Since WP >= 4.7, the Readme only contains the major version
+ VersionCompare.lesser?(version, '4.7') ? version : nil
end
# Attempts to find the WordPress version from the sitemap.xml file.
diff --git a/spec/lib/common/models/wp_version/findable_spec.rb b/spec/lib/common/models/wp_version/findable_spec.rb
index f647a7dc..3ff0e0c5 100644
--- a/spec/lib/common/models/wp_version/findable_spec.rb
+++ b/spec/lib/common/models/wp_version/findable_spec.rb
@@ -134,6 +134,13 @@ describe 'WpVersion::Findable' do
@fixture = '/3.3.2.html'
@expected = '3.3.2'
end
+
+ context 'when version >= 4.7' do
+ it 'returns nil' do
+ @fixture = '/4.7.2.html'
+ @expected = nil
+ end
+ end
end
describe '::find_from_links_opml' do
diff --git a/spec/samples/common/models/wp_version/findable/readme/4.7.2.html b/spec/samples/common/models/wp_version/findable/readme/4.7.2.html
new file mode 100644
index 00000000..f94226c3
--- /dev/null
+++ b/spec/samples/common/models/wp_version/findable/readme/4.7.2.html
@@ -0,0 +1,99 @@
+
+
+
+
+
+ WordPress › ReadMe
+
+
+
+
+
+ Version 4.7
+
+
Semantic Personal Publishing Platform
+
+
First Things First
+
Welcome. WordPress is a very special project to me. Every developer and contributor adds something unique to the mix, and together we create something beautiful that I’m proud to be a part of. Thousands of hours have gone into WordPress, and we’re dedicated to making it better every day. Thank you for making it part of your world.
+
— Matt Mullenweg
+
+
Installation: Famous 5-minute install
+
+
Unzip the package in an empty directory and upload everything.
+
Open wp-admin/install.php in your browser. It will take you through the process to set up a wp-config.php file with your database connection details.
+
+
If for some reason this doesn’t work, don’t worry. It doesn’t work on all web hosts. Open up wp-config-sample.php with a text editor like WordPad or similar and fill in your database connection details.
Once the configuration file is set up, the installer will set up the tables needed for your blog. If there is an error, double check your wp-config.php file, and try again. If it fails again, please go to the support forums with as much data as you can gather.
+
If you did not enter a password, note the password given to you. If you did not provide a username, it will be admin.
+
The installer should then send you to the login page. Sign in with the username and password you chose during the installation. If a password was generated for you, you can then click on “Profile” to change the password.
+
+
+
Updating
+
Using the Automatic Updater
+
If you are updating from version 2.7 or higher, you can use the automatic updater:
If you’ve looked everywhere and still can’t find an answer, the support forums are very active and have a large community ready to help. To help them help you be sure to use a descriptive thread title and describe your question in as much detail as possible.
There is an online chat channel that is used for discussion among people who use WordPress and occasionally support topics. The above wiki page should point you in the right direction. (irc.freenode.net #wordpress)
+
+
+
Final Notes
+
+
If you have any suggestions, ideas, or comments, or if you (gasp!) found a bug, join us in the Support Forums.
+
WordPress has a robust plugin API that makes extending the code easy. If you are a developer interested in utilizing this, see the Plugin Developer Handbook. You shouldn’t modify any of the core code.
+
+
+
Share the Love
+
WordPress has no multi-million dollar marketing campaign or celebrity sponsors, but we do have something even better—you. If you enjoy WordPress please consider telling a friend, setting it up for someone less knowledgable than yourself, or writing the author of a media article that overlooks us.
+
+
WordPress is the official continuation of b2/cafélog, which came from Michel V. The work has been continued by the WordPress developers. If you would like to support WordPress, please consider donating.
+
+
License
+
WordPress is free software, and is released under the terms of the GPL version 2 or (at your option) any later version. See license.txt.
+
+
+
diff --git a/wpscan.rb b/wpscan.rb
index 9ae911ab..5f638a3b 100755
--- a/wpscan.rb
+++ b/wpscan.rb
@@ -268,10 +268,10 @@ def main
}
if (wp_version = wp_target.version(WP_VERSIONS_FILE))
- if wp_target.has_readme? && VersionCompare::lesser_or_equal?(wp_version.identifier, '4.8')
+ if wp_target.has_readme? && VersionCompare::lesser?(wp_version.identifier, '4.7')
puts warning("The WordPress '#{wp_target.readme_url}' file exists exposing a version number")
end
-
+
wp_version.output(wpscan_options.verbose)
else
puts
+