Cancel

Tag: disclosure

  • WordPress 4.8.3, A Security Release Six Weeks in the Making

    WordPress 4.8.3, A Security Release Six Weeks in the Making

    WordPress 4.8.3 is available and is a security release for 4.8.2 and all previous versions. This release addresses an issue with $wpdb->prepare() that could lead to a potential SQL injection. While WordPress core is not vulnerable, hardening has been added to prevent plugins and themes from inadvertently causing a vulnerability. If you’re experiencing a bit…

    Jeff Chandler

  • WordPress.com Security Vulnerability Stirs Debate Over Responsible Disclosure

    WordPress.com Security Vulnerability Stirs Debate Over Responsible Disclosure

    Late last week, Yan Zhu, a Staff Technologist for the Electronic Frontier Foundation publicly disclosed a security vulnerability she discovered with WordPress.com and how it handles cookies. More specifically, she discovered the “wordpress_logged_in” cookie being sent in the clear to a WordPress authentication endpoint. She was able to use the authenticated cookie to publish blog…

    Jeff Chandler