Automattic Releases Update For Wordpress, Mitigates Security Vulnerabilities

By Author: eccuni
Total Articles: 211
Comment this article

Recently, Automattic issued an update for WordPress, the popular online blogging and publishing platform. The latest version, WordPress 3.1.3 has fixed multiple security vulnerabilities. Security flaws addressed in the latest version of the blogging platform are associated with security hardening, taxonomy query, file upload security, media security, and clickjacking. The latest version also mitigates vulnerabilities, which cause leakage of user names of non-authors.

In case of clickjacking, attackers place a fake button behind a genuine button on a legitimate site. When users click on the genuine button, they also inadvertently trigger the hidden button related to a third-party site. Attackers aim to exploit Adobe Flash and javascript vulnerabilities of web browsers through clickjacking.

Vulnerability in file upload mechanism results in improper validation of uploaded files. The flaw could cause attackers to upload .phtml file appended with dangerous file extensions. Successful exploitation of the vulnerability may cause cross-site scripting, allow unauthorized access to system information, and enable remote ...
... attackers to gain control of a computer system. The vulnerability was identified by security firm Secunia and affects WordPress 3.1.2.

The latest version also cleans up old import files, if import fails to finish. Security researchers have advised publishers to immediately upgrade to the latest version, to avoid exploitation of security flaws in the earlier versions. Web-application vulnerabilities are one of the popular targets for cybercriminals. Publishers must keep track of security advisories and guidelines, and update to latest platforms. In-house security researchers, professionals qualified in penetration testing, masters of security science, independent security experts or other developers often detect vulnerabilities. In this case, researchers Alexander Concha, John Lamansky, and experts affiliated to Microsoft identified security flaws in WordPress. Authors, and publishers may update themselves on security threats and information security practices through security blogs, online tutorials, and e-learning and online degree programs.

Automattic also released WordPress 3.2 Beta 2. The developer plans to deliver the final release of WordPress 3.2 by the end of June. The latest Beta version comes with new features such as support for Google Chrome Frame in admin and improvised admin for Internet Explorer 7 among others.

The popularity and growing use of web publishing and blogging platforms make them susceptible to intrusion attempts from cybercriminals. Associated databases of the platforms contain sensitive information such as names, author profiles, addresses, e-mail addresses, and login credentials. Use of unique and different login credentials is crucial to ensure data security. Internet users must adhere to security and software updates, and browser updates. They must use strong and unique passwords. They must adhere to cyber security tips to safeguard their computer systems and data from sophisticated Internet-based attacks. Attackers may also gain access to copyright protected information. Regular in-depth security tests of web applications and platforms are crucial to prevent security and data breach incidents.

The vibrant security threats have made it inevitable for security professionals to update themselves on latest developments by participating in security conferences, seminars, and improve their technical expertise by undertaking online university degree courses and security certifications.