There are nine unfixed vulnerabilities across five plugins this week. The vast majority of this week’s unfixed vulnerabilities all come from a single author. Unfortunately, he reused the same chunk of vulnerable code across all of his plugins. Specifically, when processing POST data, he did not include a nonce or other check to ensure that user intended to initiate the save action, leaving his code open to a Cross-Site Request Forgery vulnerability. In addition, there is no validation, filtering or sanitation performed on the data before he saves the information to the database. He then later echoes that data back out to the browser without any escaping leaving the code, and more importantly the user, open to Cross-Site Scripting vulnerabilities. An attacker could therefore combine these two vulnerabilities to steal an Admin’s session IDs on a target WordPress site.
Speaking of WPCampus, they just announced this week that WPCampus 2017 will be livestreamed for FREE!! The lineup looks fantastic this year, with a ton of incredible information. Even if you don’t work with WordPress, there are numerous sessions that are platform-agnostic. Go ahead and block off your calendar for Friday, July 14th and make time to tune back in on Saturday, July 15th. You definitely don’t want to miss this.
HighEdWeb also announced their schedule for the upcoming annual conference in Hartford, CT. I’ll be doing a pre-conference workshop this year, but will otherwise not be speaking. Instead I’m serving as co-chair for the Development, Programming and Architecture (DPA) track. And let me just warn you, the DPA track has some amazing talks lined up this year. You should probably just go ahead and plan on staying in the track for both days. 😀
Even if you aren’t interested in DPA, HighEdWeb is always an amazing conference. I understand budgets are tight, but it is well worth your money, even if you have to pay for trip yourself. I highly encourage you to go ahead and register today.