WordPress 4.2.4 Security Release

WordPress version 4.2.4 was released today, which is a security update for all previous WordPress versions.

This version fixes three cross-site scripting vulnerabilities, as well as a potential SQL injection vulnerability in WordPress Comments that could be used to compromise a site (CVE-2015-2213).

It also includes a fix for a potential timing side-channel attack and prevents an attacker from locking a post from being edited.

We encourage everyone to head over to Dashboard → Updates in their WordPress dashboard, and click “Update Now”. Otherwise, you can download WordPress 4.2.4 directly. Once you’re running WordPress 4.2.4, you are protected from these vulnerabilities.

VaultPress recommends enabling automatic WordPress updates if they are disabled on your website. We are also e-mailing all owners of affected websites with upgrade instructions.

By running the latest versions of WordPress, VaultPress, and all your themes and plugins, you help to ensure that your site remains safe, secure, and speedy! As always, if you have any questions, drop us a line.

Posted in General | Leave a comment

WordPress 4.2.3 Security Release

An important security update was released today for WordPress. This is a security release for all previous versions, and it fixes a cross-site scripting vulnerability which could allow users with the Contributor or Author role to compromise a website. WordPress versions 4.2.2 and earlier are affected by this vulnerability.

A large number of websites has been upgraded to WordPress 4.2.3 already. If you do not have automatic WordPress updates enabled, we strongly recommend you upgrade your website to version 4.2.3 immediately. We also suggest enabling automatic WordPress updates for your website.

We encourage everyone to head over to Dashboard → Updates in their WordPress dashboard, and click “Update Now”. Once you’re running WordPress 4.2.3, you’re protected from this vulnerability.

We are also e-mailing all owners of affected websites with upgrade instructions. Running the latest versions of WordPress, themes, and plugins is a great step to keep your site safe and sound.

As always, if you have any questions, drop us a line.

Posted in General | Leave a comment

Celebrating 5 Years of VaultPress

It’s VaultPress’ 5th birthday this week! In his post on June 29, 2010 — one of the first posts ever on this blog — Matt announced that we had sent out the very first Golden Ticket invites to VaultPress. In the beginning, we sent 30 invites a day, and grew gradually over the first several months. From those first Golden Tickets to the many users we support today, VaultPress has:

  • Found 201,754 infected files
  • Made 50,100,955 backup snapshots.
  • Backed up 27,615 distinct plugins and 17,675 themes

Let’s take a look back at our first tweet and some early designs:

Our designs have changed over the years, but we’ve never wavered in our commitment to making the best product we can for the WordPress community. In a recent survey of 21 professionals on the best backup WordPress plugins, we’re proud that VaultPress came out on top as the clear winner. Feedback on our product is incredibly positive — it’s great to see people like Brin Wilson of WinningWP say that VaultPress is “basically effortless.” We’re so happy to see how far we’ve come.

To celebrate our 5-year anniversary and to say thank you and give back to our users, we’ve launched an extended 3-month trial. If you want to sign up, just visit this page: https://vaultpress.com/bestof/

We hope that by extending the trial, we can help bring VaultPress to more people for free for a longer period of time.

As always, drop us a line if you have any follow-up questions!

Posted in Announcements, Community, General | 4 Comments

VaultPress Customer Stories: WP Daily Themes

Peter-NilssonPeter Nilsson started WP Daily Themes to initially write about themes and plugins but, in recent years, it has grown beyond his expectations. In his words, “Now we have many of the leading writers and experts in the WordPress community contributing with brilliant articles and tips on the blog”. Before starting his company, Peter previously worked a variety of jobs including being a sailor at one point! He finally then went to school to become a network technician and hasn’t looked back since. While he started his blogging career with Google’s blog platform back in 2007, he outgrew it by 2008 and switched to using WordPress.  Peter writes, “A new world opened up and since then I have been working with one of the best and most popular (CMS) Content Management System in the world: WordPress.”

After blogging for a couple of years, he opened up his business in 2009 to help clients with setting up WordPress, maintenance, and overall improvements to their sites. When WP Daily Themes began to grow, he turned to VaultPress to secure his content. As he puts it, “Even if you save that single document on your computer or website on your web hosting company, there is no guarantee the computer doesn’t crash or the hosting company lose your backup (which has happened to me with devastating consequences)… I have been a customer now for some years and VaultPress has proven to have been the right choice many times.”

In his spare time, he does his best to give back to the WordPress community through translating Plugins into Swedish. His most recent translation projects include WP Rollback and Birds Custom Login.

We can’t be more delighted that Peter chose VaultPress to protect his awesome content on WP Daily Themes.

You can learn more about how VaultPress can protect your site — including its contents, themes, plugins, site settings, and customizations.

Contact us with questions — or make our day, and sign up to protect your site!

Posted in Community, General | Leave a comment

WooCommerce PayPal Object Injection

The fine people at Woo have released a security patch for WooCommerce, fixing a vulnerability in their PayPal notification system.

The vulnerability affects WooCommerce 2.0.20 – 2.3.10 when a “PayPal Identity Token” is set. It allows attackers to remotely execute code, via a known vulnerability in PHP’s unserialize function.

WooCommerce 2.3.11 contains a fix for this issue, and we strongly recommend that all users upgrade to this version as soon as possible.

We’ve released a hotfix with VaultPress 1.7.5, which protects all vulnerable versions of WooCommerce from attack. We are currently attempting to deploy this update to all VaultPress users affected by the issue. We will email site owners whose sites we are unable to update.

As always, if you have any questions, please drop us a line at vaultpress.com/contact.

Posted in General, Security | Leave a comment