SoylentNews is people
SoylentNews
from the 30000-sites-need-to-patch-wordpress-NOW dept.
Critical Flaws in WordPress Quiz Plugin Allow Site Takeover:
A plugin that is designed to add quizzes and surveys to WordPress websites has patched two critical vulnerabilities. The flaws can be exploited by remote, unauthenticated attackers to launch varying attacks – including fully taking over vulnerable websites.
The plugin, Quiz and Survey Master, is actively installed on over 30,000 websites. The two critical flaws discovered by researchers include an arbitrary file-upload vulnerability, ranking 10 out of 10 on the CVSS scale; as well as an unauthenticated arbitrary file deletion error, ranking 9.9 out of 10. A patch is available for both issues in version 7.0.1 of the plugin, said the researchers with Wordfence who discovered the flaws, in a Thursday post.
"The unauthenticated arbitrary file-deletion vulnerability that was present in the plugin is pretty significant," Chloe Chamberland, threat analyst with Wordfence, told Threatpost. "Any of the 30,000 sites running the plugin are subject to any file being deleted (granted they are running a vulnerable version), which includes the wp-config.php file, by unauthenticated site users."
[...] Researchers discovered the flaws on July 17, and after various unsuccessful attempts to contact the QSM plugin team, finally reached out to the plugin's parent company, ExpressTech on Aug. 1. A patch was released on Aug. 5 in version 7.0.1. The CVE assignments for both flaws are still pending, researchers said.
"We highly recommend updating to version 7.0.1 immediately to keep your site protected against any attacks attempting to exploit this vulnerability," said researchers.
Also at www.youtube.com
(Score: 2, Flamebait) by rob_on_earth on Monday August 17 2020, @10:03AM (1 child)
I Inherited a Wordpress site with a bizarre number of plugins. when I asked for why each was added, the response was always the same. The user had Googled the functionality they wanted for the site and a plugins had always been recommended, even for functions that were built into Wordpress.
It reminded me of how many people not only downloaded, but paid for apps to make their mobile phone flash turn on and off.
Convenience always trumps security, within a certain sector of users.
Speaking of which, they never upgraded Wordpress even though the dashboard would tell them to do so every time they connected. The first step in a Wordpress upgrade is a screen warning the upgrade may break any installed plugins.
(Score: 3, Insightful) by Booga1 on Monday August 17 2020, @01:26PM
Yeah, that's not a huge shocker to me. I see that sort of thing from time to time in other contexts.
How to compute an average in Python:
"Normal" Python: (a + b) / 2
"Google" Python: First, install NumPy using one of the following methods... [xkcd.com]