Arbitrary file upload vulnerability in WordPress Ultimate Member plugin.
A critical vulnerability in the popular WordPress Ultimate Member plugin allows allows attackers to upload any files, including PHP backdoors.
Tag: WordPress
Misuse of WordPress WP-CLI could leak user passwords.
WP-CLI is a command line interface for WordPress. It is a nice and very helpful tool if you want to manage a lot of WordPress installations from a Unix shell.
Securing WordPress with a Web Application Firewall: NinjaFirewall (WP Edition).
In this article we will see how to provide a very high level of protection to a WordPress blog with a web application firewall.
NinjaScanner v1.2 introduces the quarantine sandbox.
NinjaScanner v1.2 introduces a new and unique feature, the quarantine sandbox: When moving a file to the quarantine folder, NinjaScanner can use a testing environment (a.k.a.…
Arbitrary file upload vulnerability in WordPress LearnDash LMS plugin.
While cleaning up several hacked WordPress blogs, we identified a critical zero-day vulnerability in the LearnDash LMS plugin v2.5.3 (https://www.learndash.com/) that allows an unauthenticated user to…
NinjaScanner: A powerful antivirus scanner for WordPress.
NinjaScanner is a lightweight, fast and powerful antivirus scanner for WordPress which includes many features to help you scan your blog for malware and virus.
NinjaFirewall PHP sessions debugging.
NinjaFirewall (WP and WP+ Edition) v3.4.3 introduces two new constants to help you debug potential PHP session issues such as whitelisted users being blocked by the…
NinjaFirewall Full WAF vs WordPress WAF mode.
Since version 3.4, NinjaFirewall (WP and WP+) can be installed in two different modes: Full WAF or WordPress WAF. Full WAF mode In Full WAF mode,…
Arbitrary file upload vulnerability in WordPress Delete-All-Comments plugin.
On November 20th, while auditing a hacked WordPress website, we identified a critical vulnerability in the Delete All Comments WordPress plugin v2.0, which has over 30,000…
Blocking a WordPress XML-RPC attack with the Linux kernel firewall.
One of our customers faced a large attack against his WordPress blog xmlrpc.php script. When I connected to his server, the CPU load was over 100.…