|
|
|
|
|
|
|
|
This week in WordPress
|
|
Excess XSS
|
|
|
|
|
It's been a hectic week for the team at Wordfence. "We're scrambling a bit this evening to mitigate a highly active attack on #wordpress. Details on the Wordfence blog tomorrow morning. Interesting situation," Mark Maunder, CEO of Defiant, the company behind Wordfence, tweeted yesterday.
|
|
|
|
According to QA engineer Ram Gall, Wordfence started tracking a sudden increase in attacks targeting Cross-Site Scripting(XSS) vulnerabilities against several plugins, including Easy2Map, BlogDesign, and WP GDPR Compliance, on 28 April. The attacks peaked on 3 May when the hacker group launched over 20 million exploitation attempts against half a million domains — about 30x the normal volume Wordfence typically sees in its attack data.
|
|
In other security news — again from Wordfence — Combined Attack on Elementor Pro and Ultimate Addons for Elementor Puts 1 Million Sites at Risk. Threat analyst Chloe Chamberland says Elementor Pro (not the free plugin available from WordPress.org) was the subject of a zero day vulnerability. The Elementor team has been quick to release a patch, Wordfence today tweeting: "An update: @elemntor has released Pro version 2.9.4, and our threat intelligence team has verified it fixes the authenticated file upload vulnerability. Please ensure you update your Elementor Pro plugins to 2.9.4. Kudos to Elementor for the fast fix."
|
|
|
|
Time to change your passwords
|
|
|
"Oh dear - GoDaddy users might want to read this," tweets computer scientist and cyber security researcher Alan Woodward. He links to Forbes' article GoDaddy Confirms Data Breach: What Customers Need To Know. The web host has admitted a hacker tampered with an SSH file on its servers, leading to the theft of 28,000 users' SSH credentials.
|
|
"Now might be a good time to change your passwords, folks," writes journalist Gareth Corfield in GoDaddy hack: Miscreant goes AWOL with 28,000 users' SSH login creds after vandalizing server-side file for The Register. He says GoDaddy immediately reset the affected usernames and passwords, which were used only by customers for accessing remotely hosted servers, rather than their main customer accounts. GoDaddy has committed to providing a complimentary years' worth of security and malware removal services for customers affected by the breach.
|
|
|
|
Between a block and a hard place
|
|
|
|
|
"It is inevitable that when we publish a story on the Tavern that is remotely related to the block editor or the Gutenberg project, we receive negative comments," he writes. "Despite sprinting along in its second year as part of core WordPress, there are still those who liken posts on the editor to Soviet-style mind manipulation and propaganda for certain unnamed companies."
|
Surprise — many of the 65 comments below the article (at the time of writing this) are negative. But there's also a lot of love for the block editor. "When Gutenberg came out, it seemed very strange to me… Now I and my editors love to write with the block editor… Last week we switched to the classic to try and we found it strange we saw the classic editor with nostalgia but at the same time as something outdated," comments developer Lenin Zapata.
|
|
But some readers, like developer Denis Žoljom, say they're not happy with the block editor because "… the decision making is in Automattic hands completely. All we outsiders can do is make suggestions, and do a QA for the editor in the hope it will be improved."
|
|
|
|
WordPress 💪🏼❤️
|
|
|
|
|
|
Nineteen WordPress folks sing and play along to the song, which was composed by "Song-a-day man" Jonathan Mann, with Tracy Apps, the owner of tracy apps design, on drums.
|
In Need to Smile Today? Stay WordPress Strong, Katz tells Justin Tadlock at WP Tavern that in the midst of the uncertainty of the pandemic, he feels lucky to be part of the WordPress community, "doing what we do, working on an open and thriving platform, with a culture of people who are kind to each other and support each other."
|
"This is now an ear worm. 🤪 Such a catchy tune! Nice work #WordPress people. ✊" tweets GoDaddy global field marketing senior manager Adam Warner. "The #WordPressStrong video is cool, but it's no WordPress Rap by @jason_coleman," tweets Penske Media director of editorial technology Aaron Jorbin, linking to WordPress Rap.
|
|
Meanwhile, if you need another reason to smile… GoWP tweets: "See you tomorrow at our favorite event of the week! 🤗 The #GoWPVirtualHappinessHour exists to connect with agency owners, friends and experts - like you! Join the group and see you tomorrow at 3 PM!"
|
|
|
|
|
|
|
In other news...
|
|
|
|
|
|
|
|
|
|
Not subscribed? Join the most conversational weekly email
in the WordPress community!
|
|
|
|
|
|
|
|
|
|
|
