WordPress Quietly Fixes Serious Security Flaw

In a recent security update, WordPress quietly fixed a serious code injection vulnerability in its CMS that could allow an unauthorized attacker to alter a post or page and remotely execute code, ZDNet reports. WordPress clarifies that public disclosure of this discovery was delayed by a week, as it sought time to run automatic updates to patch the vulnerability and protect users from exploits.

The bug, discovered by security firm Sucuri, was located in the REST API in Wordpress 4.7.

Aaron Campbell of WordPress further explains that since there was no indication of any exploits in the data collected from the four WAFs and WordPress hosts, public disclosure was delayed until the bug was patched. However, the CMS hosts and firewall providers, including CloudFlare, SiteLock, Incapsula and Sucuri, were kept in the loop to provide protection from exploit bids.

"Hosts worked closely with the security team to implement protections and regularly checked for exploit attempts against their users," adds Campbell.

Read more on ZDNet.