WordPress sites using Ninja Forms, a forms builder plugin with more than 1 million installations, have been force-updated en masse this week to a new build that addresses a critical security vulnerability likely exploited in the wild. The vulnerability is a code injection vulnerability affecting multiple Ninja Forms releases, starting with version 3.0 and up.
Wordfence threat analyst Ramuel Gall discovered when reverse-engineering the patch that unauthenticated attackers can exploit this bug remotely to call various Ninja forms classes using a flaw in the Merge Tags feature:
There is evidence to suggest that this vulnerability is being actively exploited in the wild, and as such we are alerting our users immediately to the presence of this vulnerability.
This flaw has been fully patched in versions 3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, and 3.6.11.WordPress appears to have performed a forced automatic update for this plugin, so your site may already be using one of the patched version. Nonetheless, we strongly recommend ensuring that your site has been updated to one of the patched versions as soon as possible since automatic updates are not always successful.
Christopher Prewitt, CTO MRK Technologies had this to say:
WordPress and WordPress plugins are always under attack. WordPress is the most popular CMS, powering over 43% of websites. Attackers are always looking to leverage their efforts, getting the most results as possible.
While WordPress appears to have performed a forced automatic update for this plugin, it is always important to validate and ensure your site and plugins are configured to automatically update.
This is good advice for anyone who runs a WordPress site. Which would include yours truly. I run very few plugins for security reasons. But if you run a WordPress site that might not be your use case. Thus Mr. Prewitt’s advice is something that you should keep in mind.
It Appears Elon Musk Broke The Ability For WordPress Sites To Post To Twitter For 24 Hours
Posted in Commentary with tags Twitter, WordPress on April 5, 2023 by itnerdAs many of you know, I no longer post on Twitter because what a clown show that it has become. But when I did, I used functionality built within WordPress called the Jetpack Social tool to do it. Well, it’s a good thing that I don’t post on Twitter as apparently Elon broke support for the Jetpack Social tool on April 3:
On April 3, Twitter suspended WordPress.com’s access to the Twitter API without warning. As a result, Jetpack Social — the built-in tool that we use to auto-share your posts to social media — is currently broken for Twitter. This means that auto-posting to Twitter via WordPress.com is not actively working.
Thankfully, this issue is isolated to Twitter, which means that Jetpack Social connections to other platforms are unaffected. Rest assured that you can continue sharing to Tumblr, Facebook, and LinkedIn without interruption.
But then the next day this happened:
The earlier reported outage has been resolved. Twitter is working again for Jetpack Social and all other functionalities that depend on Twitter. All Jetpack Social connections to Twitter, Tumblr, Facebook, and LinkedIn can be used as usual.
We are working with Twitter directly to ensure this service keeps running without interruption.
You have to wonder if WordPress paid Elon to get functionality working again. We’ll never know for sure. But the fact is that if you rely on some piece of code to do something that is related to Twitter, it may break without warning. hat alone should make you reconsider your relationship with the platform. Especially if you’re a company or someone who is trying to promote themselves.
2 Comments »