I'm a little surprised that there hasn't been more discussion on the Internet about the vulnerability affecting 3.0 to 3.9.2.

I get that no one likes it when everyone jumps on the let's bash WordPress security bandwagon, but there is such a thing as responsible disclosure. This vulnerability is extremely serious and very widespread, so I think more effort should be made to let people know, even if that results in some of those posts we all hate.

I guess I'm influenced by the fact that a) I have a copy of the proof of concept code to exploit the vulnerabilty and b) I was in the middle of the response to the Slider Revolution vulnerability.

I've seen how easy it is to hack a site with this. Find any site running 3.0 to 3.6 (12% of the entire Internet) with comments enabled and you can exploit it. If they don't have moderation turned on, you can instantly redirect any page to the page of your choosing for all visitors. I have a video of how easy it is on my website. Not to mention you can add an admin user when it's run on the backend.

So this looks more serious than the rev slider one. Also, the rev slider one potentially affected up to 1000 themes (it turned out only 338 were actually affected). This one affects 12% of the entire internet!

The rev slider author was highly criticised for not making everyone aware of the issue. They were notified of a vulnerabilty, fixed it and then released an update marked as containing a security fix. That wasn't enough - people said they should have done more to make all users aware of how serious it was.

In this case, the WordPress project was notified of a vulnerability, they fixed it and then released an automatic update (yay!). They also released a post saying there was a critical security issue, which is more than what the rev slider author did. But more than half the affected users didn't get updated automatically. How many of those will actually see the blog post about the vulnerabilty? Maybe a few will see it in the dashboard. But have we really done everything we can to make all users aware of how serious it is (the thing that the rev slider author was accused of not doing)?

The first thing most of the 12% are going to know about this is when they get hacked. I guess that's fine? Serves them right for not staying updated? I've seen people express that sentiment. Personally, I think we can do a better job of getting the word out.

I guess we were lucky in the rev slider case because once it did get wider exposure, Envato could step in and email everyone who had ever purchased a potentially affected theme. There's no one to do that in this case... Which means the only alternative is spread this news far and wide by writing about how serious it is and how many people are affected.

Anyway, sorry for the rant. I'm just genuinely surprised how this has been like a pebble dropped in the ocean (compared to a boulder being dropped in for the rev slider one). Somehow, I was expecting more.