WordPress to add auto-update feature for themes and plugins

guest · Mar 16, 2020

WordPress to add auto-update feature for themes and plugins
Auto-update feature is only available for the WordPress CMS core now. To be expanded for themes and plugins
March 16, 2020
https://www.zdnet.com/article/wordpress-to-add-auto-update-feature-for-themes-and-plugins/

The WordPress developer team is working on adding an auto-update mechanism to themes and plugins, a common source of website hacks, primarily because site owners usually install themes and plugins, and then forget to update them.
Work on this feature began months ago.

Once the auto-update option rolls out for the stable versions of the WordPress content management system (CMS), site owners will be able to configure themes and plugins to update themselves by checking an option in their site's admin panels.
WordPress site owners who would like to test the new themes and plugins auto-update feature can install this plugin on their sites.
CODE WAS PRESENT IN WP SOURCE SINCE 2013
The code behind this new feature was already present in the WordPress source code since version 3.7, released in October 2013 [...] The code for performing background updates for themes and plugins was also added, but never enabled by default.
Click to expand...

Cyber-security firms like Sucuri, Wordfence, WebARX, and NinTechNet have often pointed out that a vast majority of today's hacked WordPress sites are being compromised after hackers exploit vulnerabilities in out-of-date plugins and themes.
This feature is expected to reduce the number of hacked WordPress sites, once it rolls out with the upcoming WordPress 5.5 release.
Click to expand...

guest · Aug 12, 2020

WordPress 5.5 rolls out with auto-updates for plugins, themes
Feature aimed at improving the security of the WordPress ecosystem has been a ‘long time coming’
August 12, 2020
https://portswigger.net/daily-swig/wordpress-5-5-rolls-out-with-auto-updates-for-plugins-themes

WordPress 5.5 lands today with a new feature that will ensure plugins automatically update by default, shrinking the window of opportunity for cybercriminals looking to exploit known security vulnerabilities.

The feature, which also auto-updates WordPress site themes, has been absorbed into the WordPress core codebase after being tested and optimized as a beta plugin.
Webmasters who update to version 5.5 can now opt into all background updates, or enable and disable the feature on specific themes or plugins.
Click to expand...

‘Long time coming’

“It’s hard to underplay how important this is,” Tim Nash, WordPress platform lead at web hosting service 34SP.com, tells The Daily Swig.
“This has been a long time coming” he adds, pointing out that smartphone apps and operating systems have long updated automatically.

The WordPress team has issued a field guide for version 5.5, and advice on managing auto-updates, controlling email notifications and site health info, and recommended usage of the updates API.
Click to expand...

guest · Oct 22, 2020

Over one million WordPress sites receive forced update to security plugin after severe vulnerability discovered
October 22, 2020
https://www.tripwire.com/state-of-security/featured/loginizer-wordpress-plugin-forced-update/

Loginizer, a popular plugin for protecting WordPress blogs from brute force attacks, has been found to contain its own severe vulnerabilities that could be exploited by hackers.

The flaw, discovered by vulnerability researcher Slavco Mihajloski, opened up opportunities for cybercriminals to completely compromise WordPress sites.
The flaw can be exploited if a user attempts to log into a Loginizer-protected website with a carefully-crafted username. Vulnerable versions of Loginizer did not properly validate and sanitise the username to prevent SQL injection and Cross-Site Scripting (XSS) attacks.

The threat was significant, and made even more serious due to the fact that over one million sites are running the Loginizer plugin – believing it to be protecting their websites from attack.
Click to expand...

WordPress has had the ability to force updates on third-party sites since version 3.7 of the blogging platform, but it is a feature that has rarely been seen in action.

WordPress.org administrator Samuel Wood responded to a Loginizer support thread where users were questioning how their installation plugin had been updated without their permission:

“WordPress.org has the ability to turn on auto-updates for security issues in plugins. Has since WP 3.7, and we’ve used it for security releases for plugins many times.”
The cat is out of the bag and there may be malicious hackers exploring how they might explore the flaw on any sites that have escaped the patch.
Click to expand...

guest · Oct 30, 2020

mood said: ↑

Over one million WordPress sites receive forced update to security plugin after severe vulnerability discovered October 22, 2020
Click to expand...

Patch takeover: App developers, like WordPress, left to weigh backlash of forced security updates
October 29, 2020
https://www.scmagazine.com/website-...st-weigh-backlash-of-forced-security-updates/

In an uncommon move, WordPress developers earlier this month automatically pushed an important security update for the popular Loginizer plug-in to roughly 1 million people, which caught some unsuspecting users off-guard in the process.

The decision, which was made to ensure a significant vulnerability didn’t wreak havoc, is one all software and app developers wrestle with themselves when establishing patching policies: under what circumstances should software updates be taken out of the hands of users? And should potential backlash factor into the decision making?
Citing the plug-in’s author, the WPScan WordPress Vulnerability Database reported that the forced update successfully patched 89 percent of the WordPress sites that use Loginizer, a plugin that helps fight brute-force attacks.
Click to expand...

“WordPress should make sure that its terms of service and EULA contain clauses that expressly allow them such unrequested updates in a clear and conspicuous manner,” recommended Kolochenko, who warned there could be potential civil damages or even criminal hacking charges if an update did cause problems.

Effective communication is especially key, experts concur, especially if something does go awry.

“It could be as simple as a mechanism to email administrators informing them why an update is being pushed. Likewise, a mechanism to monitor any issues caused by updates would be useful,” said Gall.
Puglia also suggested that software developers give users a deadline to install the updates themselves before commencing the involuntary push.
Click to expand...

Log in or Sign up

WordPress to add auto-update feature for themes and plugins

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

WordPress to add auto-update feature for themes and plugins

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches