Jun01
0

Flaw in WordPress Plugin Jetpack

Hacking, Plugins, Vulnerability Share this post

Owners of WordPress-based websites should update the Jetpack plug-in as soon as possible because of a serious flaw that could expose their users to attacks.

Jetpack is a popular plug-in that offers free website optimization, management and security features. It was developed by Automattic, the company behind WordPress.com and the WordPress open-source project, and has over 1 million active installations.

Researchers from Web security firm Sucuri have found a stored cross-site scripting (XSS) vulnerability that affects all Jetpack releases since 2012, starting with version 2.0.

Since the JavaScript code is persistent, it will get executed in users’ browsers in the context of the affected website every time they view the malicious comment. This can be used to steal their authentication cookies, including the administrator’s session; to redirect visitors to exploits, or to inject search engine optimization (SEO) spam.

“The vulnerability can be easily exploited via wp-comments and we recommend everyone to update asap, if you have not done so yet,” said Sucuri researcher Marc-Alexandre Montpas in a blog post.

Sites that don’t have the Shortcode Embeds module activated are not affected, but this module provides popular functionality so many websites are likely to have it enabled.

The Jetpack developers have worked with the WordPress security team to push updates to all affected versions through the WordPress core auto-update system. Jetpack versions 4.0.3 or newer contain the fix.

About the Author

Wordpress Developer, Security Consultant, Blogger. Works in Edmonton Alberta Canada.

Leave a Reply

Your email address will not be published. Required fields are marked *

%d bloggers like this: