Please note, none of our clients are vulnerable to the following security issue
In the past few days WordPress has bene suffering from a serious security breach. Securi, a specialist website security company identified a severe content injection (privilege escalation) vulnerability affecting the REST API. This vulnerability allows an unauthenticated user to modify the content of any post or page within a WordPress site.
A fix for this was silently included on version 4.7.2 along with other less severe issues. This was done intentionally to give everyone time to patch.
This privilege escalation vulnerability affects the WordPress REST API that was recently added and enabled by default on WordPress 4.7.0.
One of these REST endpoints allows access (via the API) to view, edit, delete and create posts. Within this particular endpoint, a subtle bug allows visitors to edit any post on the site.
The REST API is enabled by default on all sites using WordPress 4.7.0 or 4.7.1. If your website is on these versions of WordPress then it is currently vulnerable to this bug.
For most users, the website should update itself, but we advise anyone with a WordPress website to check to make sure their website is up to date.
As part of our hosting plans we have carried out the required updates for all our clients.
If you are concerned about security issues with your hosting and would like some help feel free to contact us here or on 01253 963016
