WP-Super-Cache - Critical Vulnerability, Be sure to upgrade

2.9K followers

11 years ago

As many as 1 million sites imperiled by dangerous bug in WordPress plugin

As many as a million websites could be imperiled by a critical vulnerability recently discovered in WP-Super-Cache, a WordPress plugin that generates static HTML files from dynamic WordPress blogs.

The persistent cross-site scripting bug allows attackers to insert malicious code into WordPress-published pages that use the extension, according to a blog post published Tuesday by security firm Sucuri. Anyone who relies on the plug in should immediately upgrade to version 1.4.4, which has fixes for that bug and several others.

<snip>

Full article: http://arstechnica.com/security/2015/04/as-many-as-1-million-sites-imperiled-by-dangerous-bug-in-wordpress-plugin

Join FREE & Launch Your Business!

Exclusive Bonus - Offer Ends at Midnight Today

Hours

Minutes

Seconds

2,000 AI Credits Worth $10 USD

Build a Logo + Website That Attracts Customers

400 Credits

Discover Hot Niches with AI Market Research

100 Credits

Create SEO Content That Ranks & Converts

800 Credits

Find Affiliate Offers Up to $500/Sale

10 Credits

Access a Community of 2.9M+ Members

By continuing, you agree to our Terms of Service and Privacy Policy

No credit card required

Recent Comments

New message...

janicebowles

11 years ago

Thanks for the heads up Bob! :)

Skilly

11 years ago

Don't you mean version 4.1.1?

BobBarr

11 years ago

The 1.4.4 version is what's listed in the article. If the plugin is already at a 4.0 or 4.1 level, that must be a typo. Since I don't have that particular plugin installed, I'm just going by what the article said.

Skilly

11 years ago

Thanks Bob. I think I was confusing it with another number.

BobBarr

11 years ago

That's totally understandable given the number of different plugins at various version numbers. :=) I just confirmed that the latest version is 1.4.4 as it's listed in the article. (I should have done that in response to your previous comment.)

bsmith1222

11 years ago

Thanks for sharing

MarionBlack

11 years ago

Thanks for sharing Bob. I've disabled the plugin on my websites because it interferes with my ability to see the changes I make (in real time). ~Marion

BobBarr

11 years ago

As long as you have the plugin disabled, I don't think that your sites are exposed to this vulnerabilty. (Not 100% certain on that.) You may want to update it anyway just in case you do want to reenable it in the future.

I am a bit surprised, though, that the plugin keeps you from seeing changes as you're making them in your admin area. I would have expected that the cache would be cleared whenever you update a post or page.