WordPress on Omid Farhang

Linux Malware targets WordPress and common Plugins

Sun, 15 Jan 2023 23:55:43 +0330

Doctor Web has discovered a malicious Linux program that hacks websites based on a WordPress CMS. It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites.

What they can do?

Upon their command, it is able to perform the following actions:

WordPress hardened with XSS, DoS and SSRF fixes

Tue, 25 Jun 2013 10:57:44 +0000

With the second security and maintenance release of WordPress 3.5, the developers of the popular open source blogging software have closed 12 bugs, seven of them security issues. In their announcement, the developers “strongly encourage” all users to update all their installations of the software to version 3.5.2 immediately. In addition to the fixed vulnerabilities, the new release also includes some proactive changes intended to harden the platform against attacks.

WordPress 3.4 update closes important security hole

Fri, 29 Jun 2012 19:57:00 +0000

The WordPress developers have released version 3.4.1 of their popular open source publishing platform, fixing a number of bugs and closing security holes, one of which is rated as important. WordPress 3.4, which has already been downloaded 3 million times since being released two weeks ago, contains a important privilege escalation flaw that accidentally allowed all administrators and editors on multi-site installations to use unfiltered_html. This could have been exploited by users for cross-site scripting (XSS) attacks by, for example, publishing posts containing malicious code.

WordPress fixes file upload security problems

Mon, 23 Apr 2012 18:52:00 +0000

The H-Security: The developers of the popular open source blog engine WordPress have released a security update for the software. WordPress 3.3.2 fixes unspecified bugs in three external file upload libraries used in the software and other security problems with the application.

The bugs affect both WordPress’s current file uploading library Plupload as well as the SWFUpload and SWFObject libraries; these were bundled with older versions of the application and might still be in use by certain plugins on the current versions of WordPress. The developers did not go into detail about the specifics of the security holes but thanked three people from the WordPress community for responsibly disclosing them. Three more fixes address a privilege escalation in the blog engine’s multi-site system and two cross-site scripting vulnerabilities in the core components of WordPress. More details on all of these patches and also some additional smaller fixes can be found in the change log.

WordPress.com suffers hacker attack – how to change your password

Thu, 14 Apr 2011 07:32:00 +0000

Sophos Labs: Millions of blog owners around the world are being advised to consider their password security, after WordPress.com was hacked.

To its credit, Automattic – the company behind the WordPress.com blogging platform – didn’t mince its words or try to apply any spin to the incident, explaining it had suffered a “low-level (root) break-in to several of [its] servers, and potentially anything on those servers could have been revealed.”

Follow up: Hacker Gains Access To WordPress.com Servers, Site Source Code Exposed

Wed, 13 Apr 2011 23:18:00 +0000

Follow up from: Hacker Gains Access To WordPress.com Servers

Tech Crunch: WordPress.com has revealed that someone has gained root-access (“low-level,” as in deep) to several of its servers this morning and that VIP customers’ source code was accessible. WordPress.com VIP customers are all on “code red” and in the process of changing all the passwords/API keys they’ve left in the source code.

“Tough note to communicate today: Automattic had a low-level (root) break-in to several of our servers, and potentially anything on those servers could have been revealed.

Hacker Gains Access To WordPress.com Servers

Wed, 13 Apr 2011 17:51:00 +0000

Tech Crunch: WordPress.com has revealed that someone has gained access to several of the their servers this morning and that VIP customers’ source code was accessible. WordPress.com customers are all on ‘code red’ and in the process of changing all the passwords/api keys they’ve left in the source code.

“Tough note to communicate today: Automattic had a low-level (root) break-in to several of our servers, and potentially anything on those servers could have been revealed.

WordPress hit with second big attack in two days

Tue, 08 Mar 2011 11:31:00 +0000

CNET wrote: The popular blogging-site hoster WordPress was hit with another distributed denial-of-service attack this morning, the second in two days.

“Unfortunately, the DDoS attack from yesterday returned in a different form this morning and affected sitewide performance,” the company said in a notice on its Automattic site, which serves as a dashboard for the service. “The good news is that we were able to mitigate it quickly and performance returned to normal around 11:15 UTC. We are continuing to monitor the situation closely.”

WordPress Adds Feature for Embedding Tweets

Sat, 06 Nov 2010 16:03:00 +0000

Mashable: Months ago, Twitter released a clunky tool called Blackbird Pie for embedding tweets in blog posts. Today WordPress has radically simplified and improved tweet embedding with a new feature, also named Twitter Blackbird Pie.

Beginning today, WordPress.com users simply need to copy a tweet’s URL and paste it on a line by itself to embed it in a blog post.

Pasted URLs are converted into full tweets, which means these embedded tweets look as good as screenshots, but include the link back to the tweet, a link to the source and a retweet option. The new feature will also save users time — letting them avoid the much more manual process of snapping screenshots of tweets.

Microsoft Kills Live Space blogs

Wed, 29 Sep 2010 00:47:00 +0000

Microsoft announced that it has collaborated with WordPress and now onwards it will be the default blogging platform for Windows Live users. This means Microsoft is killing it’s own blogging platform and suggesting users to go for better platform called ‘WordPress’.

In TechCrunch Disrupt conference, Windows Live Director ‘Dharmesh Mehta’ announced that all existing Windows Live Spaces users will be migrated over to an account at WordPress.com.

So now onwards users who sign up for a Windows Live account get free Hotmail , the Xbox Live site , a free blog from WordPress.com and other services.

WordPress and PHP-based management systems under attack?

Tue, 11 May 2010 22:37:00 +0000

A variety of sources are reporting that blog hosting sites with WordPress-created sites and php-based management systems such as Zen Care eCommerce are being infected with malicious scripts.

Websites hosted by ISP DreamHost, GoDaddy, Bluehost and Media Temple have been found with the malcode, according to H-Online.com.

The malicious scripts download malcode and block Google’s Safe Browsing API from alerting users.
Story here: “Large-scale attack on WordPress”

The Sucuri Security blog has offered clean-up instructions for those with infected pages here.

WordPress 3.0: The 5 Most Important New Features

Tue, 11 May 2010 13:53:00 +0000

Brian Casel is a web designer and owner of ThemeJam WordPress Themes and CasJam Media. You can follow Brian on his blog at briancasel.com or on Twitter @CasJam.

WordPress has long been known as a dedicated blogging platform, giving users the tools they need to publish their message and interact with readers. However, with the official release of version 3.0, set to drop this month, the platform will be much closer, if not well within the territory of a content management system (CMS).

WordPress Official App For iPad

Sat, 03 Apr 2010 12:31:00 +0000

iPad apps seems to be getting more faster approved than apple iphone apps, we have seen many iPad apps being released. WordPress official app has been released for iPad today. As there lot more space on iPad for bloggers to write a web blog post through this wordpress app, this app seems to be useful.

However it does not have any new features so it is just the iphone app being ported for iPad on apple ipad store, Below are some screenshots with which you can get the idea on how does this app will look like on iPad.