2 Comments

  1. Peter

    When will be fixed WordPress 2.3-4.7.5 – Host Header Injection in Password Reset vulnerability?

    Report

    • Scott

      Good question. I was surprised to see that they had not patched that exploit (CVE-2017-8295) in 4.7.5.

      I realize that some may not take it as seriously, since it requires the server to be poorly configured. Unfortunately it’s that type of thinking that allows all hacks like this to remain unfixed in the first place. (Think recent Microsoft Windows hacks and ransomware exploits.) Security pros have to start thinking more like hackers.

      Any time an exploit is discovered, it should be fixed, period, especially when the fix is not difficult. The WP core team could patch this with minimal effort.

      Since no one else was doing it, we added mitigation for this exploit in this week’s update of WP-SpamShield, so that all users are protected from it, making it impossible to pull off.

      If folks aren’t sure if they are vulnerable or not, that’s one option. If you have ability, updating server configs are another option — the best option.

      Either way, that code in core does need to be patched.

      Report

Comments are closed.

%d bloggers like this: