Security Update for WordFence

An important security update has been released for the WordFence Security Plugin in Version 6.0.22. The security update fixes an XSS vulnerability that was reported by Matt Rusnak.

We have attempted to automatically upgrade all of our customers to the newest version of WordFence. You can verify that you’re running the latest version of WordFence Security on the Plugins page in your WordPress dashboard. We also added this security threat to our security scanner so anyone who begins using VaultPress after today will be notified of this threat.

If you have a site using WordFence but do not have VaultPress installed, you can protect yourself by upgrading under Dashboard → Updates in your WordPress dashboard.

As always, if you have any questions, drop us a line!

Posted in Security | Leave a comment

Security Update for Akismet

An important security update has been released for the Akismet Plugin in Version 3.1.5. The security update fixes an XSS vulnerability that was reported by Sucuri.

You can protect yourself by upgrading to the latest version of Akismet 3.1.5, under Dashboard → Updates in your WordPress dashboard.

We have released VaultPress 1.7.8 which will protect your site from this vulnerability. We have also attempted to automatically upgrade our customers to this newer version of VaultPress and Akismet. You can verify that you’re running the latest version of Akismet 3.1.5 on the Plugins page in your WordPress dashboard.

As always, if you have any questions, drop us a line!

Posted in Security | 2 Comments

Security Update for Jetpack

A couple of important security and maintenance updates have been released for the Jetpack plugin.

You can protect yourself by upgrading to the latest version of Jetpack 3.7.2, under Dashboard → Updates in your WordPress dashboard.

The security updates fixed a vulnerability, reported by Sucuri, that allowed an attacker to exploit the contact form present in Jetpack through a specially crafted malicious email address. A vulnerability was also reported by Jaime Delgado Horna of Listae that showed that Jetpack version 3.7.0 is vulnerable to an information disclosure vulnerability in certain hosting configurations.

Both of these threats have been addressed in the recent update.

We have attempted to automatically upgrade any VaultPress customers that are running an outdated version of Jetpack. You can verify that you’re running the latest version of Jetpack 3.7.2, on the Plugins page in your WordPress dashboard.

As always, if you have any questions, drop us a line!

Posted in General, Security | Leave a comment

WordPress 4.3.1 Security Release

WordPress version 4.3.1 was released today, which is a security update for all previous WordPress versions. This version of WordPress addresses three issues, including two cross-site scripting vulnerabilities and a potential privilege escalation. (CVE-2015-5714). WordPress 4.3.1 also fixes twenty-six bugs! You can read the full announcement here.

To help keep sites using VaultPress secure, we have released a hotfix to proactively protect our users. A hotfix is essentially an immediate security fix delivered by the plugin to plug a vulnerability found elsewhere (either in WordPress core or another plugin). For those who haven’t upgraded yet, it will provide protection before you are able to. Finally, we are also e-mailing all owners of affected websites with upgrade instructions.

We encourage everyone to head over to Dashboard → Updates in their WordPress dashboard, and click “Update Now”. Otherwise, you can download WordPress 4.3.1 directly. Once you’re running WordPress 4.3.1, you are protected from these vulnerabilities.

As a friendly reminder, VaultPress recommends enabling automatic WordPress updates if they are disabled on your website. By running the latest versions of WordPress, VaultPress, and all your themes and plugins, you help to ensure that your site remains safe, secure, and speedy! As always, if you have any questions, drop us a line.

Posted in General, Security | Tagged , | Leave a comment

Interview with WordPress.org’s Security Czar, Nikolay Bachiyski

At WordCamp Europe 2015 , Matt Mullenweg named Nikolay Bachiyski the first Security Czar for the WordPress project . With over 10 years of experience contributing to the WordPress project, Nikolay is a great fit and has embraced the role. I had the opportunity to chat with him about this new role and his thoughts on current security trends and best practices.

What’s the focus of your new role as Security Czar?

My responsibilities are to coordinate the security efforts of WordPress.org – a lot of it is incident response – making sure we respond quickly, have solid fixes, and everybody involved is informed.

How does security reporting work within WordPress.org?

Anyone can report security issues. We have an email address to where people can send reports (we always appreciate security reports at security@wordpress.org — even if you’re not sure, we’re happy to check it out). Thankfully, most issues are not reported publicly as there are a lot of nice people who take the time and effort to report security issues privately.

We have a security team of trusted people who have the technical and communication skills to deal with most issues. The group has worked together well in the past, but I’m here to help make everything a bit more organized and streamlined. Everyone in the group is really smart and talented, but during hectic moments, sometimes communication can drop off and it becomes hard to know what has been done, what remains to be done, and who is doing what. Overall, these communication issues can be challenging.

We also have relationships with the bigger hosts and plugin authors, so they can help us test fixes to make sure we don’t break users’ websites with security updates.

What changes do you hope to implement in how the WordPress community responds to security concerns?

There aren’t any big changes planned. We’re mainly concerned with streamlining the internal processes already in place — making sure all of the issues go through the same process and that we have everything covered for each issue.

What are some tips you can offer for securing a WordPress site?

Always complete updates as soon as you can and make sure to use strong passwords. Those two steps go a long way in keeping your site safe. If possible, I recommend enabling auto-updates. Also, when choosing plugins, check to make sure you are using a plugin that is regularly updated! You can confirm this by checking the changelog for a plugin.

As an example, here’s the changelog for VaultPress .

How have security threats evolved over time? Is the internet safer or less safe now?

These days, the public pays a lot more attention to security issues. In the late 90s, I remember that it was so easy to hack into websites. Generally, I would say security measures and efforts have gotten much better over time. Of course, the people who are trying to break things or coordinate attacks are also getting more sophisticated, very often merging more than one attack. Here’s an example.

That said, it’s much easier today to cover most of the common problems. And with the increasing importance of software in our world, security problems are only getting more critical as well since the impact is higher. As a result, the average security level is higher because people care about security a lot more. Today, security is something you incorporate throughout the software building process rather than something you might add at the end.

Put simply: security threats grow in complexity and importance as software does.

How did you discover your knack for all things security? Are there any resources you’d like to share with someone who wants to learn more about the kind of work you do?

At some point in college, I went to a network security course. The interesting thing about security is that in order to build secure software, you have to think like an attacker. To think like an attacker, you need a strong understanding of how everything works. I guess I was just curious and, over time, security became a big part of writing software for me.

As for resources, I’d recommend checking out WordPress.tv security presentations and OWASP (Open Web Application Security Project).

On that note, if you want to learn more about Nikolay and his security work check out his recent WordPress Security Presentation on WordPress.tv:

Posted in Community, Security | Tagged , , | 3 Comments