Menu
WordPress quickly patches second critical vulnerability

WordPress quickly patches second critical vulnerability

It's the second time in a week WordPress had fixed flaws involving malicious comments

WordPress patched a second critical vulnerability in its Web publishing platform on Monday, less than a week after fixing a similar problem.

Administrators are advised to upgrade to WordPress version 4.2.1. Some WordPress sites that are compatible with and use a plugin called Background Update Tester will update automatically.

WordPress is one of the most-used Web publishing platforms. By the company's own estimation, it runs 23 percent of the sites on the Internet, including major publishers such as Time and CNN.

The latest flaw was found by Jouko Pynnönen[cq] of Klikki Oy, a Finish software company. Pynnönen found WordPress was vulnerable to a cross-site scripting flaw if an attacker inserted malicious JavaScript into a comments field. The script runs when someone views the comment, according to an advisory.

Cross-site scripting flaws are among the most dangerous and common Web vulnerabilities, allowing rogue code to run that should be forbidden.

If a WordPress administrator is logged in when the malicious comment is viewed, the attacker can then execute arbitrary code on the server through the plugin and theme editors. It is also then possible to change the administrator's password, create new administrator accounts or manipulate content on a site. The vulnerability can't cause damage from an ordinary reader viewing the comment.

Klikki Oy alleged that WordPress had stopped communicating with it last November when Klikki found a different vulnerability in WordPress. With the latest flaw, Klikki said it had also tried to notify WordPress through the Finnish computer security authority, CERT-FI, and HackerOne, which offers a service for managing vulnerability reports and rewards.

On April 21, WordPress patched a vulnerability similar to the one Pynnönen came across. Cedric Van Bockhaven[cq] found that WordPress was vulnerable to a cross-site scripting attack involving comments due to a MySQL database behavior it allowed.

He found that rogue code could be executed when a person hovered over a malicious script inserted into a comments field. Proof-of-concept code written by Van Bockhaven showed how a new user could be added in the administration panel. The flaw could also be used to download a plugin that runs malicious server-side code, he wrote on his blog.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securityWordpressExploits / vulnerabilitiesKlikki Oy

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments