WordPress 3.8.2 Security Release

BoerenkoolMetWorst · Apr 9, 2014

This releases fixes a weakness that could let an attacker force their way into your site by forging authentication cookies. This was discovered and fixed by Jon Cave of the WordPress security team.

It also contains a fix to prevent a user with the Contributor role from improperly publishing posts. Reported by edik.
This release also fixes nine bugs and contains three other security hardening changes:

Pass along additional information when processing pingbacks to help hosts identify potentially abusive requests.

Fix a low-impact SQL injection by trusted users. Reported by Tom Adams of dxw.

Prevent possible cross-domain scripting through Plupload, the third-party library WordPress uses for uploading files. Reported by Szymon Gruszecki.

Click to expand...

http://wordpress.org/news/2014/04/wordpress-3-8-2/

Dermot7 · Apr 10, 2014

The Jetpack team just released a critical security update to fix a security vulnerability in the Jetpack WordPress plugin. The vulnerability allows an attacker to bypass the site’s access control and publish posts on the site. All versions of JetPack since October, 2012 (Jetpack 1.9) are vulnerable, and all users should update to version 2.9.3 ASAP.

Jetpack is a very popular plugin for WordPress with almost 10 million downloads, so the impact of such vulnerability can be very big if users do not update.
Click to expand...

Critical Update for JetPack WordPress Plugin | Sucuri Blog

Jetpack 2.9.3: Critical Security Update — Jetpack for WordPress

Jetpack version 2.9.3 contains a critical security update, and you should update your site and any you help manage as soon as possible. You can update through your dashboard, or download manually at -http://downloads.wordpress.org/plugin/jetpack.2.9.3.zip-
During an internal security audit, we found a bug that allows an attacker to bypass a site’s access controls and publish posts. This vulnerability could be combined with other attacks to escalate access. This bug has existed since Jetpack 1.9, released in October 2012.

Fortunately, we have no evidence of this being used in the wild. However, now that this update is public, it’s just a matter of time before exploits occur. To avoid a breach, you should update your site as soon as possible. (The vulnerability has been disclosed on the MITRE Common Vulnerabilities and Exposures system as CVE-2014-0173.)
Click to expand...

Log in or Sign up

WordPress 3.8.2 Security Release

BoerenkoolMetWorst Registered Member

Dermot7 Registered Member

Log in or Sign up

WordPress 3.8.2 Security Release

BoerenkoolMetWorst Registered Member

Dermot7 Registered Member

Useful Searches