[Sam]

http://thehackernews.com/2015/04/WordPr ... ility.html

It appears that there is a serious vulnerability / exploit in Wordpress. It basically grants full admin access.



https://wordpress.org/news/2015/04/wordpress-4-2-1/

4.2.1 patches this exploit.

[Cloudlin]

Thats messed up :S Good thing I don't use wordpress

[Sam]

Thats messed up :S Good thing I don't use wordpress

So many users do though. There are also bots which go around trying to crack Wordpress admin passwords because most people never change their admin user from "admin". We had to go put some mod-security rules on our shared server because it was causing a huge load.

[jade100]

oh, its good to know that info. I am not to wordpress though

[DinheiroGelada]

One thing I learned from reading here and there is to always set up your wordpress blog to automatically update. This way if people find a vulnerability, eventually wordpress will fix it, and you won't be vulnerable for long if it's set to auto update!

So, if you use wordpress, set it to auto update

[CyberFreak]

A vulnerability in Wordpress? Surely this can't be true!

Good job they now have a automatic update option now because alot of people are usually happy to run outdated software and this is a pretty severe security issue.

[JordanDD]

Hey

Wordpress is my friend since the first beta version (Yep, I was a beta tester )

Vulnerability can't be avoid, but I am sure the Auttomatic team (Wordpress creators) would fix everything very rapidly !

[LShun]

That of course, unless some evil genius outsmarted the developer's and make serious damage before action is taken, but hopefully we don't see this happen.

[Nimo]

Thanks for the info. I must soon update my all blogs since they're still on earlier vulnerable versions

[CyberFreak]

Nimo, I would also update your plugins while you are at it I can see atleast 1 out of date plugin that you are using.

[Nimo]

Nimo, I would also update your plugins while you are at it I can see atleast 1 out of date plugin that you are using.

Sorry, I couldn't understand what you mean . Can you please clarify?

[LShun]

I think he means that one of your plug-ins are out of date and he suggest's updating it to solve some hidden vulnerabilities.

[Nimo]

If so, how could he know about my site's plugins?
He doesn't have dashboard access in my site

[darrensurrey]

Thanks for posting about this. Will check my WP sites!

[CyberFreak]

If so, how could he know about my site's plugins?
He doesn't have dashboard access in my site

Look behind you

Boo!

Only joking. There are a few ways to see what plugins and versions users are running. Sometimes by just looking at the site you can work out what plugins they are using and the version (either roughly or exactly) by the features/appearance of the plugin.

In this case, I viewed the source of your homepage in my browser and it contained some information about 1 plugin that caught my attention

Code: Select all

<!-- This site is optimized with the Yoast WordPress SEO plugin v1.6.3 - https://yoast.com/wordpress/plugins/seo/ -->

It shows the plugin you use and the version. That isn't really a problem if it is up to date but it isn't.

https://wordpress.org/plugins/wordpress-seo/changelog/

Shows the latest version as being 2.1.1. The version you are using is like 11 version out of date. The changelog also states some security fixes were made in some of those versions so really you need to update and soon.

See... Nothing malicious. Just using my web browser and publicly available information provided by your site. Something that even the dumbest script kiddie could do.

Update!!!!!! Update!!!!!! Update!!!!!!!!

[LShun]

If so, how could he know about my site's plugins?
He doesn't have dashboard access in my site

Look behind you

Boo!

Only joking. There are a few ways to see what plugins and versions users are running. Sometimes by just looking at the site you can work out what plugins they are using and the version (either roughly or exactly) by the features/appearance of the plugin.

In this case, I viewed the source of your homepage in my browser and it contained some information about 1 plugin that caught my attention

Code: Select all

<!-- This site is optimized with the Yoast WordPress SEO plugin v1.6.3 - https://yoast.com/wordpress/plugins/seo/ -->

It shows the plugin you use and the version. That isn't really a problem if it is up to date but it isn't.

https://wordpress.org/plugins/wordpress-seo/changelog/

Shows the latest version as being 2.1.1. The version you are using is like 11 version out of date. The changelog also states some security fixes were made in some of those versions so really you need to update and soon.

See... Nothing malicious. Just using my web browser and publicly available information provided by your site. Something that even the dumbest script kiddie could do.

Update!!!!!! Update!!!!!! Update!!!!!!!!

Haha, I agree, and its quite nice actually because people don't need to go so deep to find it too

[trover]

Thanks for this, I have not blogged with wordpress yet but i'll keep this in mind for future use.

[ganther]

This is news to me. Thanks so much for sharing!

[paulojunior85]

The problem affects the theme TwentyFifteen, installed by default, and the Jetpack plugin, which has more than one million installations.
In focus is the package "genericons" WordPress, something that WordPress add-ons use and comes with an unsafe file, leaving the site open to cross-site scripting vulnerabilities. If a hacker get deceive a user and do you click on a malicious link, he can acquire full control of said user site.

Fortunately, the fix for the problem is simple: just remove the file "example.html" genericons of any instance in your WordPress.

[halcyon220]

The problem affects the theme TwentyFifteen, installed by default, and the Jetpack plugin, which has more than one million installations.
In focus is the package "genericons" WordPress, something that WordPress add-ons use and comes with an unsafe file, leaving the site open to cross-site scripting vulnerabilities. If a hacker get deceive a user and do you click on a malicious link, he can acquire full control of said user site.

Fortunately, the fix for the problem is simple: just remove the file "example.html" genericons of any instance in your WordPress.

how do you know this?