If you are a WordPress user and using version 4.7 or 4.7.1, it’s time to update it. A vulnerability that was fixed under the cover of darkness is being exploited by hackers who want to make names for themselves. Version 4.7.2 has been released and fixes the issue, but many who choose not to automatically update their systems may be just asking for trouble if they wait too much longer. So far, hackers wanting to show off their skills have defaced approximately 1.5 million instances. It’s likely they will start looking for ways to monetize this soon.
The issue was an unauthenticated privilege escalation vulnerability in a REST API endpoint. The update was pushed to customers in late January and developers waited until a week later to disclose the issue to give those who didn’t do the automatic updates some time to apply it before it went public. Unfortunately, some didn’t get to it in time.
Everyone is busy, so it is understandable when tasks start getting pushed down the priority list. However, it is really in any organization’s best interest to prioritize patching their systems; for reasons just like this. While the damage here is more to reputation, once they hackers start sending out ransomware to unpatched machines, it’ll cost more than some embarrassment. Even if current backups are available to restore, and they should be a part of the regular operations tasks, the time spent getting it back in order will likely be rather costly. It could be a lot more if there are no backups.
So, if you don’t want to do the automatic patching that is offered in WordPress or other products, make sure that when a patch is released, you get it applied as soon as possible. This will keep your organization from appearing on a list of sites some hacker decided to deface for fame.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
