Vulnerability fixed in Jetpack 4.0.3. Severity: 6.1 (Medium) By Mark Maunder for WordFence. Original here. An XSS vulnerability has been fixed in Jetpack version 4.0.3 which was released yesterday. If you haven’t automatically been updated to Jetpack 4.0.3 please update immediately. The CVSS score we have calculated for this vulnerability is 6.1 (Medium). If you…
What Hackers Do With Compromised WordPress Sites By Dan Moen for WordFence. Original here. We often talk to site owners who are surprised that their sites are targeted by attackers. Most of them assume that if there isn’t any juicy data to steal, like credit card numbers, that compromising their site is a worthless exercise.…
Vulnerability in User Role Editor – Users Can Become Admins By Mark Maunder for WordFence. Original here. There is a major vulnerability in a popular plugin with over 300,000 active installs: User Role Editor 4.24 and older. The vulnerability allows any registered user to gain administrator access. For sites that have open registration, this is a…
How Attackers Gain Access to WordPress Sites By Dan Moen for WordFence. Original here. On this blog we write a lot about different vulnerabilities that could lead to site compromise. In our Learning Center we go deep on a myriad of important topics related to WordPress security. Our handy checklist, for example, includes 42 items…
Original post by Dan Moen on Wordfence.com here. During our research into what the WordPress community knows about hacked websites, we discovered that there is very little data available on the subject. We decided to conduct a survey, inviting a portion of our community to participate. We received responses from 1,605 people who reported having a website…
Get Rid of Data to Help Secure It By Mark Maunder for WordFence. Original here. Last week I spent some time chatting with Mike Dahn who is the co-founder of the BSides information security conferences globally. He’s also organizer of BSides San Francisco and is well known and respected in information security circles. We had a…
A Backdoored WordPress Plugin and 3 Additional Vulnerabilities By Mark Maunder for WordFence. Original here. We have several plugin vulnerabilities we’d like to bring to your attention this week. First up is a backdoor that was added to the Custom Content Type Manager plugin. The backdoor was added by a malicious coder who gained access…
Scary Data – Trends in Malware, Phishing, Site Cleaning and Bad Networks By Dan Moen for WordFence. Original here. At Wordfence we have great visibility into the size and scale of the threat facing the WordPress community. Our software protects well over a million sites worldwide. This week we thought it would be interesting to…
WordPress-Delivered Ransomware and Hacked Linux Distributions By Mark Maunder for WordFence. Original here. In a rather unfortunate turn of events earlier this month, the Hollywood Presbyterian Medical Center was infected with ransomware. Ransomware, if you’re unfamiliar with it, encrypts everything on your workstation and then tells you to pay an attacker to decrypt your system and…
Why Wordfence Supports Strong Encryption Without Backdoors By Mark Maunder for WordFence. Original here. This morning global headlines are discussing Apple’s move to oppose a court order issued by the US government regarding breaking into it’s own iPhone. This case has far reaching consequences and is part of a wider debate on cryptography and whether…