Hackers Are Exploiting Recently Patched WordPress Bugs, Putting Millions of Websites at Risk

An anonymous reader quotes a report from TechCrunch: Hackers are breaking into websites that run vulnerable versions of the popular blogging software WordPress, according to several cybersecurity firms. One estimate puts the number of vulnerable WordPress websites at tens of millions as of Monday. Last week, WordPress patched two critical security flaws, urging people who run its software on their websites to update it "immediately." The vulnerabilities are so severe that WordPress enabled forced updates where possible. Since then, cybersecurity companies Patchstack, Hexastrike, and WatchTowr have all warned that hackers are exploiting the vulnerabilities in the wild, meaning they are taking over websites that are still running susceptible versions of WordPress.

It's unclear how many WordPress-powered websites on the internet are at risk, but it's possible to make some educated guesses. The vulnerable versions of WordPress are 6.9.0 through 6.9.4, and 7.0.0 to 7.0.1. According to WordPress' official stats, there are more than 400 million websites that run those flawed versions, although these statistics likely don't reflect websites that have recently been patched. Cybersecurity consultant Daniel Card, who told TechCrunch that he looked at a sample of around 3,500 WordPress websites, estimates that less than 15% are vulnerable. Applying Card's projection across the total population of WordPress websites on the internet, the total figure would still be around 90 million. [...] One of the critical WordPress bugs was found and reported by Adam Kues of cybersecurity firm Searchlight Cyber, which dubbed it WP2Shell. Paired with the other bug, hackers can take full remote control of vulnerable websites.

WordPress: the Flash of web servers

[zeiche]

how many bugs/exploits will we need to endure before WordPress goes the way of Adobe Flash?

Re:

[DarkOx]

Let's be real, even if wordpress code quality isn't the highest of its CMS peers at least the core product is probably not worse than the vast majority of server software out there.

The real issue here is AI. The time it takes and the range of capable people who can now reverse engineer a patch, and generate exploit code from has been greatly reduced and greatly expanded respectively.

Patch management that once got exposed systems patched the same day is no longer adequate, if you can't be patched within hou

WP REST API

[_merlin]

Most of the high-severity bugs seem to be in the REST API. This has been the case ever since they introduced it years ago. If you just disable the REST API, you can avoid most of the issues.

Re:

[Tablizer]

I thought it was dodgy add-ons that caused most problems.

Anyhow, popularity alone makes a tool a hacking target. If everyone switched to say Joomla, then it would become the main target.

Re:WP REST API

[_merlin]

Bugs in plug-ins and themes are a separate (and arguably bigger) issue. But for vulnerabilities in WordPress itself, the REST API is the gift that keeps on giving. It's been a liability ever since it was added.

Re:

[Tablizer]

Any REST examples of this that are not injection...or at least not obvious injection?

Re:

[HuskyDog]

If you just disable the REST API, you can avoid most of the issues.

On my site which runs Gentoo, I've already been able to apply the update, but on the other one where I have to run Debian I am of course still waiting for the new version to be made available! Disabling the REST API has enabled me to keep that site live while I wait.

Headline could be repeated every year

[haruchai]

Is there a good reason to keep using WordPress?

Re:

[Idimmu Xul]

i used claude and cursor to migrate ~40 wordpress blogs to cloudflare pages - theres no point using wordpress any more unless you're doing something for ecommerce, and tbh we're moving from woocommerce to shopify now too. decades of non stop maintenance is wearing thin now tbh

Re:

[Errol backfiring]

Only one: it does not presume a huge organization with a zillion employee roles before you can think of starting to to something. Most other CMSes have at least 10 levels of creators, editors, correctors, etc, before you can post something.

Re:

[Asteconn]

WordPress, usually, is 'good enough' for most SMEs that need something with editing capability; but nothing with any hugely complicated business or ecommerce logic.

For the agency I work for, WordPress is our default entry-level platform for SMEs that don't need ecommerce or complex custom development. It is *considerably* better than it was 10 years ago.

Get it managed

[TheMiddleRoad]

Somebody runs the updates and scans for hacks for me. Since then, no issues.

Re:

[coofercat]

^^ this!

Honestly, if your WP isn't managed, you've got headache after headache. It's such an enormous target and a variable code base that unless you keep on top of every update, you'll end up getting hacked at some point. It'll just be some script kiddie defacing your site, and you'll probably get it all back again real quick, but it's a hassle you don't need.

I'd like to see Wordpress broken in half so the admin and clever bits are in one place and the actual hosted stuff is somewhere else. The server part

Consider a static site generator

[tepples]

I'd like to see Wordpress broken in half so the admin and clever bits are in one place and the actual hosted stuff is somewhere else. The server part of it needs to be as dumb as possible, and definitely not allow any sort of logins.

If you want "as dumb as possible", the search keyword for that is "static site generator". Then you can redirect /wp-admin/ to Automattic's front page.

Re:

[coofercat]

Oh for sure - all my stuff is either Pico, or more recently Grav - simple, much less hackable and also a lot faster.

However, there are *oodles* of WP sites out there. Every tom, dick and harry has one - and those need something doing that those people can understand. Improving WP bit by bit just isn't cutting it, they're just one update away from a hack, so the only solution I can see there is a re-architecture.

What?

[zmollusc]

"Hackers Are Exploiting Recently Patched WordPress Bugs" ?
They must be pretty rubbish patches if hackers can still exploit the bugs.

Forgot who said it...

[jddj]

WordPress: a remote root shell with a cool blogging feature.

And...I run it.

Already updated before I saw this.

WordPress again

[gweihir]

This thing seems to have the most incompetent developers, ever.

Well, good, thing I don't use WordPress

[bsdetector101]

Nothing is safe !

1998 wants it's SQL injection hack back :o

[Mirnotoriety]

“WordPress versions 6.8 and higher are vulnerable to an SQL injection issue.” ref [github.com]

SQL injection mentioned here:

How Was SQL Injection Discovered? [archive.org]

SQL injection mentioned in Phrack Magazine Issue 54 [phrack.org] 1998:

“I worked with a fellow WT'er on this problem. He did the good thing and told Microsoft, and their answer was, well, hilarious. According to them, what you're about to read is not a problem, so don't worry about doing anything to stop it.”

- WHAT'S THE PROBLEM? MS SQL

Re: 1998 wants it's SQL injection hack back :o

[jddj]

I'm pretty shocked SQL injection is still a thing, at least among BFD apps and platforms. (Hobbyists, self-taught and CSCI 101, sure. You don't know 'til you know).

Doesn't SQL injection require that your code clobbers together a query with string concatenation?

And therefore, doesn't it collapse completely if you parameterize queries?

Maybe I'm missing something here, but it seems like you could audit for query string concatenation and prohibit this practice.

Re:

[Mirnotoriety]

> Doesn't SQL injection require that your code clobbers together a query with string concatenation? And therefore, doesn't it collapse completely if you parameterize queries?

No, you use Stored Procedures [mysqltutorial.org].