Pierluigi Paganini
June 23, 2016
WordPress is one of the most popular content management systems for this reason is a privileged target of hackers. It is quite easy to scan the web searching for websites running old version affected by known vulnerabilities that could be exploited for various illegal activities.
WordPress is spending a significant effort in securing its CMS, in April it issued several updates.
WordPress has recently issued the version 4.5.3 that patches more than two dozen vulnerabilities, including 17 bugs introduced in the last three releases. Many of the vulnerabilities can be exploited remotely and allow an attacker to control of a website running on WordPress.
“WordPress 4.5.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.” states WordPress.
Some of the flaws could be exploited by attackers to remotely gain complete control of the vulnerable WordPress.
The last update issued by WordPress addressed a redirect bypass vulnerability in WordPress customizer API, two cross-site scripting flaws, an information disclosure bug in the revision history, a flaw that allows for unauthorized category removal from a post, and a denial-of-service issue the oEmbed protocol implemented by WordPress CMS to display embedded photos or video when users link third-party content.
Other vulnerabilities include a password vulnerability via stolen cookies and some less secure sanitize_file_name edge cases.
Websites that support automatic background updates are already beginning to update to WordPress 4.5.3, otherwise you can download it manual form Download WordPress 4.5.3.
[adrotate banner=”9″]
(Security Affairs – WordPress 4.5.3 , hacking)
