WordPress 5.1.1 Security and Maintenance Release available to download

WordPress has a new Security and Maintenance Release so please update your websites as soon as possible if they haven’t updated automatically yet. This release includes 14 fixes, it’s a short-cycle maintenance release, so according to WordPress team, there will be another update in the matter of several weeks.

What’s fixed? Well, there were several critical security issues one of them related to comments (filtering and storing them in the database) which allowed to execute Cross-Site Scripting (XSS) attack by the maliciously crafted comment. This WordPress vulnerability discovered by Simon Scannell from RIPS Technologies. All latest versions like 5.1 and earlier releases are affected so once again – please update now!

Continue reading WordPress 5.1.1 Security and Maintenance Release available to download

WordPress plugins for WooCommerce by Multidots endangered thousands of online stores

Multidots Inc. is a software development company from India that has developed a wide range of various WordPress plugins. About a month ago ThreatPress Security Research Team found a lot of vulnerabilities in ten plugins designed by Multidots to extend the capabilities of WooCommerce. As you can understand, these plugins designed for online stores powered by WooCommerce / WordPress. ThreatPress notified the Multidots instantly about the issues with their WordPress plugins, usually developer fixes problem as soon as possible, but in this case, everything went quite a different way.

Vulnerable plugins by Multidots

So, overall ThreatPress found that there are ten vulnerable plugins. All of them hosted on WordPress.org plugin repository. Here’s the list of these plugins (plugin name, active installs and vulnerability type):

Continue reading WordPress plugins for WooCommerce by Multidots endangered thousands of online stores

ThreatPress report of WordPress vulnerabilities for the 2017 year

ThreatPress published a summary of all WordPress vulnerabilities detected in the 2017 year. This beautiful info-graphic (below) gives statistical information collected from ThreatPress database of WordPress vulnerabilities and data available on such open sources like WordPress.org website.

All of the WordPress plugins that were marked as vulnerable in the 2017 year have more than seventeen million active installs. Just imagine how many sites were at potential risk. I think we’re talking about a number that exceeds five million websites. Five million!!! OK, let’s see what more do we have on this infographic.

ThreatPress 2017 year report in numbers

  • 221 vulnerability added to the database of WordPress vulnerabilities compared to the 234 vulnerabilities in the 2016 year.
  • 202 plugins were identified as vulnerable, 153 of them hosted on WordPress.org plugin repository.
  • 5 WordPress themes were identified as vulnerable, this number could be much bigger, but it’s hard to access and check themes from premium repositories.
  • The most common vulnerability type was a Cross-Site Scripting (XSS) with a SQL Injection (SQLi) on a second place and Broken Access Control on the third.
  • Other quite common vulnerability types in the 2017 year were Cross-Site Request Forgery (CSRF), Arbitrary File Upload, BYPASS, Arbitrary File Download, PHP Object Injection and Local File Inclusion.
  • Top five vulnerable plugins in the 2017 year (by the number of active installs according to WordPress.org data) were Yoast SEO, WooCommerce, Smush Image Compression and Optimisation, Duplicator and Loginizer.
  • There were 8 WordPress security-related releases in the 2017 year.

Continue reading ThreatPress report of WordPress vulnerabilities for the 2017 year

WordPress REST API vulnerability mowing un-updated websites

WordPress REST API vulnerability found in WordPress 4.7.1 version made a tremendous impact on a large number of websites. Beware if you still have a website running on the older than WordPress 4.7.2 version. I would recommend you to leave this post for a few minutes to update all your WordPress sites immediately.

WordPress 4.7.2 Security Release

WordPress 4.7.2 Security Release published on January 26, 2017. Primarily this version had a description of three fixed security issues. First one was related to the “Press This” function and its weak user permission control. The second one related to the WP_Query. An overhaul was made to prevent third-party plugins, and themes cause SQL injections. And the last one fix related to the post list table vulnerability to Cross-Site Scripting (XSS) attacks. That’s it. Only three bugs fixed. Nothing extraordinary or dramatic. People were updating their websites with no rush, WordPress automatic update service updated a lot of them just automatically.

This peaceful feeling lasted for about a week. Then suddenly the fourth issue was added to the WordPress 4.7.2 update description. An unauthenticated privilege escalation vulnerability discovered in a WordPress REST API endpoint by Marc-Alexandre Montpas of Sucuri Security.

Continue reading WordPress REST API vulnerability mowing un-updated websites