HIGH RISK: wp-feedstats plugin vulnerable
While testing the wp-feedstats plugin I found two or more critical security vulnerabilities that may allow an attacker to gain full access to your WordPress blog.
The developer of the popular plugin was contacted yesterday, however, I am yet to receive a response; in the mean time, I would strongly suggest all users disable this plugin ASAP!
A full advisory will be published in 30 or more days, when we feel satisfied the vendor has had sufficient time to produce a fixed version of the plugin, and that users have had adequate time to upgrade the plugin.
Random Posts
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
Comments
[...] Frank berichtet hat Blogsecurity festgestellt, dass es eine Sicherheitslücke in dem Plugin gibt. Aus diesem Grund empfiehlt es [...]
Daniel, I did make a start: http://blogsecurity.net/wordpress/articles/article-280507/
I’m using another plugin called Feed Statistics, I hope this can help the people with the insecure one:
[...] das WP-FeedStats Plugin für Wordpress eine Sicherheitslücke haben soll habe ich es für diesen Blog ersteinmal abgeschaltet. Sobald es ein Update gibt werde [...]
Daniel, I haven’t tested this, but thanks for the alternative. I quite like feedburner, but thats just me.
I can’t use feedburner because I have RSS channels for all categories of my website (a lot), feedburner is good for only some categories. By the way, thanks to blogsecurity team for your great job.
[...] 2 David von Blogsecurity hat sich nun die neue Version nochmal vorgenommen und kann keinerlei Sicherheitslücke finden, [...]
[...] BlogSecurity released a warning regarding a critical security vulnerability found in WordPress wp-feedstats plugin. The author has made this information public, and thus the advisory has been released early with details found at the plugins homepage. We advise all wp-feedstats users to please upgrade to the latest version, available here. [...]
[...] Plugin WP-FeedStats weist wohl Sicherheitslücken auf. Es empfiehlt sich, nach Angaben von BlogSecurity das Plugin vorerst zu [...]