Menu
WordPress silently fixes dangerous code injection vulnerability

WordPress silently fixes dangerous code injection vulnerability

The flaw could allow unauthenticated users to modify any post or page in a WordPress site

Developers of the widely used WordPress content management system released an update last week, but intentionally delayed announcing that the patch addressed a severe vulnerability.

WordPress version 4.7.2 was released on January 26 as a security update, but the accompanying release notes only mentioned fixes for three moderate risk vulnerabilities, one of which did not even affect the platform's core code.

On Wednesday, a week later, the WordPress security team disclosed that a fourth vulnerability, much more serious than the others, was also patched in version 4.7.2.

The vulnerability was discovered by researchers from web security firm Sucuri and was reported privately to the WordPress team on January 20. It's located in the platform's REST API (application programming interface) and allows unauthenticated attackers to modify the content of any post or page within a WordPress site.

"We believe transparency is in the public’s best interest," WordPress core developer Aaron Campbell said in a blog post Wednesday. "It is our stance that security issues should always be disclosed. In this case, we intentionally delayed disclosing this issue by one week to ensure the safety of millions of additional WordPress sites."

According to Campbell, after learning about the flaw, the WordPress developers reached out to security companies that maintain popular web application firewalls (WAFs) so they can deploy protection rules against possible exploits. They then contacted large WordPress hosting companies and advised them on how to implement protections for their customers before an official patch was released.

The vulnerability only affects WordPress 4.7 and 4.7.1, where the REST API is enabled by default. Older versions are not affected, even if they have the REST API plug-in.

"We’d also like to thank the WAFs and hosts who worked closely with us to add additional protections and monitored their systems for attempts to use this exploit in the wild," Campbell said. "As of today, to our knowledge, there have been no attempts to exploit this vulnerability in the wild."

While that's good news, it doesn't mean that attackers won't start exploiting this vulnerability now that the information is out. WordPress is the most popular website building platform, which makes it a very attractive target for hackers.

Webmasters should make sure that they update their WordPress sites to version 4.7.2 as soon as possible if they haven't done it yet.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Show Comments