During an internal audit of the WP Fastest Cache plugin, we uncovered an Authenticated SQL Injection vulnerability and a Stored XSS (Cross-Site Scripting) via Cross-Site Request Forgery (CSRF) issue.
If exploited, the SQL Injection bug could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords). It can only be exploited if the classic-editor plugin is also installed and activated on the site.
Successfully exploiting the CSRF & Stored XSS vulnerability could enable bad actors to perform any action the logged-in administrator they targeted is allowed to do on the targeted site.
We reported the vulnerabilities to this plugin’s author via email, and they recently released version 0.9.5 to address them. We strongly recommend that you update to the latest version of the plugin and have an established security solution on your site, such as Jetpack Security.
Continue reading → Multiple vulnerabilities in WP Fastest Cache plugin
Versions before 4.5.1 of the Software License Manager plugin for WordPress have an exploitable Cross-Site Request Forgery (CSRF) vulnerability. Any user logged in to a site with the vulnerable extension can, by clicking a link, be tricked to delete an entry in the plugin’s registered domain database table. The link can be distributed in an email, or on a website the victim user is likely to visit.
The good news is, there’s not much else that can be done by exploiting this weakness. And the attacker needs to know the id of the domain they wish to delete from the database beforehand.
Still, we recommend anybody running version 4.5.0 or earlier of the plugin to upgrade as soon as possible.
Continue reading → CSRF Vulnerability Found in Software License Manager Plugin
Recently the Jetpack team found some infected files in one of our hosted customers’ sites, and quickly traced the source of infection back to the Workreap theme by Amentotech. We started an investigation and uncovered a number of vulnerable AJAX endpoints in the theme; the most severe of these was an unauthenticated unvalidated upload vulnerability potentially leading to remote code execution and a full site takeover.
We reported the vulnerabilities to the Amentotech team via the Envato Helpful Hacker program, and the issues were addressed promptly by them. Version 2.2.2 of the theme was released on June 29, 2021 that fixes the found vulnerabilities.
Due to the seriousness of the vulnerabilities, we highly recommend all users of the Workreap theme to upgrade to version 2.2.2 or later as soon as possible.
Download the upgrade from the theme website and install it manually, or upgrade automatically via the Envato market plugin.
Continue reading → Multiple vulnerabilities in Workreap theme by Amentotech
At Jetpack, we are continuously working to develop a better product for you and your website. This month, we bring the popular Story Block to the web editor, a feature previously exclusive to mobile. This release also includes a fix for a security vulnerability for the Carousel feature.
We consequently encourage you to update all sites that you administer as soon as possible.
Continue reading → Jetpack 9.8: Engage your audience with WordPress Stories
One of the greatest benefits of WordPress is its extendability — there’s a plugin for nearly any task you could imagine so you can build a website that accomplishes anything that you want.
Does this mean you should load up on plugins? No. The more plugins you have, the slower your site loads, which negatively impacts your visitors’ experience. And some plugins can conflict with one another or with your theme, leading to errors or downtime.
That’s why Jetpack is a great option for WordPress sites: with dozens of tools in a single plugin, it provides a ton of functionality without weighing down your site.
Continue reading → What Does the Jetpack Plugin Do?
If you own a WordPress agency and could automate critical service tasks for your clients, you’d be better positioned for expansion and growth. Sounds great, right? But it’s a lot easier said than done.
Web design company FreshySites is doing exactly this with the help of Jetpack. They’ve built over 1,900 websites and actively manage about 1,200. Yet they’ve found a way to reduce the person-power required to deliver more services for an increasing number of clients.
With a small team, they’re completing more tasks for more clients. Let’s see how they do it.
Continue reading → How WordPress Agency FreshySites Uses Jetpack to Scale
One of WordPress’s biggest benefits is plugins, which let you expand your site’s functionality to meet your exact needs. There are no limits to the type or number of plugins you can install and activate on your WordPress website — there are currently thousands available in the WordPress repository.
But with this unlimited flexibility comes responsibility, since each new plugin introduces its own set of potential issues, from site slowdowns to crashes and compatibility issues. With a little knowledge and a little Jetpack, you can resolve the three most common challenges — or prevent them from happening in the first place.
Continue reading → How to Avoid Common WordPress Plugin Problems with Jetpack
Jetpack 7.9.1 contains a critical security update. You should update all sites that you administer as soon as possible.
Continue reading → Jetpack 7.9.1: Maintenance and Security Release
In today’s digital world, your online presence can end up being the lifeblood of your business. This is why it’s imperative that your site is continuously up and running, and that you mitigate its downtime.
To do so, it’s wise to get started with uptime monitoring to ensure that your website is available and accessible at all times. And Jetpack has a useful uptime monitoring solution for you, and it’s available for free.
Today, we’ll learn why uptime monitoring is crucial for every WordPress website owner, and how using it can even save you money. You’ll come away understanding just how easy it is to get uptime monitoring notifications sent to your email address, as well.
Continue reading → The Importance of Uptime Monitoring With Jetpack