0day Vulnerability in Easy WP SMTP Affects Thousands of Sites
Marc-Alexandre Montpas The Easy WP SMTP plugin authors have released a new update, fixing a very critical 0day vulnerability. When leveraged, this vulnerability gives unauthenticated attackers the…
Browsing Category
WordPress Security
698 posts
Arbitrary Directory Deletion in WP-Fastest-Cache
The WP-Fastest-Cache plugin authors released a new update, version 0.8.9.1, fixing a vulnerability (CVE-2019-6726) present during its install alongside the WP-PostRatings plugin. According to seclists.org:…
Insufficient Privilege Validation in SiteGround Optimizer & Caldera Forms Pro
While investigating the SiteGround Optimizer and Caldera Forms Pro plugins we have discovered a critical privilege escalation vulnerability. It was not being abused externally and…
How to Add SSL & Move WordPress from HTTP to HTTPS
Juliana Lewis Moving a WordPress website from HTTP to HTTPS should be a priority for any webmaster. Recent statistics show that over 33% of website administrators across…
Fake Browser Updates Push Ransomware and Bank Malware
Denis Sinegubko Recently we came across a malicious campaign injecting scripts that push fake browser updates onto site visitors. This is what a typical fake update request…
The Importance of Website Logs
Krasimir Konov As a security company, we deal with a lot of compromised websites. Unfortunately, in most cases, we have limited access to customer logs, which is…
Spam Injector Disguised as License Key in WordPress Website
Moe O Here at Sucuri, we clean WordPress websites every day. There are various types of common malware, but when we stumble upon a different scenario, our…
Spam Injector Disguised as a License Key
A client reported some weird spam URLs injected on their WordPress website and after an investigation, it turned out that the hacker was hiding the…
OWASP Top 10 Security Risks – Part III
Gerson Ruiz To bring awareness to what threatens the integrity of websites, we are continuing a series of posts on the OWASP top 10 security risks. The…
Using Innocent Roles to Hide Admin Users
Cesar Anjos All across the internet, we find guides and tutorials on how to keep your WordPress site secure. Most of them approach the concept of user…
Side Effects of the Site_url Hack
We\’ve been cleaning many sites infected by the so-called site_url hack–the result of the WP GDPR Compliance plugin vulnerability. The sites are broken because their…