Wordpress Wordpress 4.7.2 Security Update

eva2000 · Jan 27, 2017

Wordpress 4.7.2 security update out now WordPress 4.7.2 Security Release. Get updating folks !

WordPress 4.7.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.7.1 and earlier are affected by three security issues:

The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it. Reported by David Herrera of Alley Interactive.

WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability. Reported by Mo Jangda (batmoo).

A cross-site scripting (XSS) vulnerability was discovered in the posts list table. Reported by Ian Dunn of the WordPress Security Team.

Thank you to the reporters of these issues for practicing responsible disclosure.
Click to expand...

eva2000 · Feb 7, 2017

Sucuri folks outline exploits and hacks for pre-4.7.2 lower versions at https://blog.sucuri.net/2017/02/wordpress-rest-api-vulnerability-abused-in-defacement-campaigns.html

We are currently tracking 4 different hacking (defacement) groups doing mass scans and exploits attempts across the internet. We see the same IP addresses and defacers hitting almost every one of our honeypots and network.

If google is correct, these defacers seem to be succeeding.
Click to expand...

eva2000 · Feb 7, 2017

Email I got from Sucuri

Since we released our disclosure on the WordPress core REST API vulnerability last week (affecting versions 4.7 and 4.7.1) our team has been monitoring active malware campaigns in the wild, with several in the past day.

There are still many websites that remain unpatched and vulnerable.

If you have not updated your site to WordPress 4.7.2 yet - do it now!

According to our firewall research team, there are over 65,000 pages already infected by hacking/defacement groups who are leveraging this vulnerability.

We suspect that these attacks will continue throughout the week with new ones serving SEO spam and other lucrative malware campaigns. We expect the rate of compromise to slow once the majority vulnerable websites have been compromised.

Update WordPress to 4.7.2 immediately to protect yourself from these new campaigns.
Click to expand...

Log in / Register

Forums

Join the community today

Wordpress Wordpress 4.7.2 Security Update

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

Wordpress Wordpress 4.7.2 Security Update

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.