Category
Uncategorized
-
CSRF Vulnerability Found in Software License Manager Plugin
Versions before 4.5.1 of the Software License Manager plugin for WordPress have an exploitable Cross-Site Request Forgery (CSRF) vulnerability. We recommend to upgrade the plugin as soon as possible.
-
Jetpack Acquires WordPress Plugin Social Image Generator
We’re thrilled to announce that Jetpack has acquired Social Image Generator, a WordPress plugin founded by Daniel Post. Social Image Generator automatically creates social share images for your content, saving hours of tedious work. It creates images for all major social networks including Facebook, Twitter, LinkedIn, Pinterest, VK, WhatsApp, iMessage, and Reddit. Simply share your…
-
Malware using the REST API for Remote Code Execution
In this post we cover an example of a malware using the REST API to allow bad actors to run remote code on the server.
-
Meet the Skateboarding Nomad Living the Open Source Life
He’s not sanctioned, not approved, and nobody has more on the line. We finally tracked down the skateboarding nomad responsible for a stunning #WordPress grassroots effort.
-
Arbitrary Role Change/Privilege Escalation in HM Multiple Roles WordPress plugin
While investigating a security advisory about an arbitrary role change/privilege escalation issue in the HM Multiple Roles WordPress plugin, the Jetpack Scan team discovered that the fix was incomplete and left the plugin still vulnerable. The issue is fully fixed in version 1.3 of the plugin, and we advise any sites using any earlier version…
-
Severe Vulnerability Patched In WooCommerce Currency Switcher
During an internal audit of the woocommerce-currency-switcher plugin, we uncovered a very severe local file inclusion vulnerability. This security flaw could enable attackers to leak sensitive information like database credentials, cryptographic keys, and may allow arbitrary code execution in some instances. We reported the vulnerabilities to the WOOCS team via email last week, and they…
-
Finding the Best WordPress Speed Plugin: 6 Plugins and 6,000 Real Websites Tested
Looking for the best plugin to speed up WordPress? We tested the top six WordPress speed plugins to find the best.
-
Multiple vulnerabilities in Workreap theme by Amentotech
Recently the Jetpack team found some infected files in one of our hosted customers’ sites, and quickly traced the source of infection back to the Workreap theme by Amentotech. We started an investigation and uncovered a number of vulnerable AJAX endpoints in the theme; the most severe of these was an unauthenticated unvalidated upload vulnerability…
-
Fake Plugin Alert: WordPress Plugin and User Backup Tool
Attackers are abusing compromised accounts to install a fake WordPress plugin called: WordPress Plugin and user backup Tool.
-
Jetpack from Anywhere: The Mobile App is Here
What’s better than world-class security & analytics tools in a single plugin? The ability to access them on the go. See the future — Jetpack’s new mobile app.
