WordPress 5.1.1 Patches Critical Vulnerability: Update now

djbaxter

Administrator
Joined
Jun 28, 2012
Messages
2,791
WordPress 5.1.1 Patches Critical Vulnerability
by Sarah Gooding, WordPress Tavern
March 13, 2019

WordPress 5.1.1 was released yesterday evening with an important security update for a critical cross-site scripting vulnerability found in 5.1 and prior versions. The release post credited Simon Scannell of RIPS Technologies for discovering and reporting the vulnerability. Scannell published a post summarizing how an unauthenticated attacker could take over any WordPress site that has comments enabled:

An attacker can take over any WordPress site that has comments enabled by tricking an administrator of a target blog to visit a website set up by the attacker. As soon as the victim administrator visits the malicious website, a cross-site request forgery (CSRF) exploit is run against the target WordPress blog in the background, without the victim noticing. The CSRF exploit abuses multiple logic flaws and sanitization errors that when combined lead to Remote Code Execution and a full site takeover.​

Since WordPress ships with comments enabled by default, an attacker could exploit this vulnerability on any site with the default settings. Auto-updates went out yesterday but administrators who have background updates disabled are advised to update immediately.

The maintenance release also includes the ability for hosts to offer a button to prompt their users to update PHP ahead of WordPress’ planned minimum PHP version bump in 5.2. The “Update PHP” notice can be filtered to change the recommended version.
Version 5.1.2 is expected to follow in two weeks.
 

Weekly Digest

Weekly Digest
Subscribe/Unsubscribe

Trending: Most Viewed

Promoted Posts

New advertising option: a promoted post by a Sterling Sky employee reviewing your product or service; this will also be shared on the Sterling Sky & LSF Twitter accounts, our Facebook group, LinkedIn, and both newsletters. More information...

Local Search Forum


Google Product Exert

@LocalSearchLink

Join Our Facebook Group

Top