Topic · 3 items
WordPress
This page brings together what's moving in the WordPress ecosystem: core releases, plugins and builders, vulnerabilities to patch. I write it for developers, integrators and site owners who want to know what changes for them and what to do, without reading every announcement.
WordPress 7.2 rebuilds wp_kses() on the HTML API
The filter that sanitizes HTML saved by users without the unfiltered_html capability is being rebuilt on the HTML API, targeting 7.2 or 7.3. The function signature stays the same, but the output changes: lowercase tags, double-quoted attributes, disallowed script elements removed along with their contents, and text such as <$500 escaped instead of stripped. The wp_kses_force_legacy_parser filter restores the old behavior. WordPress 7.2 ships on December 8, with beta 1 on October 20.
Next step
Starting with beta 1, run the tests of your themes and plugins that compare filtered HTML, and look for contributor content that would change when saved.
WordPress 7.1.3 fixes seven vulnerabilities
The October 6 release fixes seven vulnerabilities, including a stored XSS on the Comments screen, a SQL injection in the WXR export and unauthenticated access to comments on private posts. Several require a contributor account or higher. Fixes are announced for older branches back to 4.7.
Next step
Update to 7.1.3 and clear your page cache, including cached Imgur embeds; on an older branch, make sure your version actually received the fix, and review who holds a contributor role or higher.
Bricksforge under attack, and a campaign that hides its own admin account
The Bricksforge plugin, up to 3.1.8.9, allows unauthenticated file uploads leading to code execution; it has been actively exploited since October 7, and 3.1.8.10 fixes it. Another campaign exploits stored XSS flaws in Ninja Forms (before 3.15.4) and WPC Product Bundles (before 8.6.7): a single execution in an admin session leaves behind an account hidden by a mu-plugin, a secret login URL and a fake file manager plugin. The campaign write-up lists the indicators to look for.
Next step
Update these plugins, then compare the administrators in the database with those shown in the dashboard, inspect wp-content/mu-plugins and regenerate your salts.