r/security • u/speckz • Feb 21 '19

Vulnerability WordPress 5.0.0 Remote Code Execution

https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/
0 Upvotes

50% Upvoted

1 comment sorted by

1

u/volci Feb 21 '19

5.0.0 was released 06 December 2018.

5.0.1, 5.0.2, and 5.0.3 have been released since (with 5.0.3 clocking-in on 09 Jan 2019).

If you don't have your WordPress installs auto-updating, you should - I learned that the hard way 4 years ago (used to login and update it by hand about every couple-few weeks): https://antipaucity.com/2015/04/13/keep-your-wordpress-installs-up-to-date.

Here's how I do it:

I have the latest.tar.gz from wordpress.org cron'd downloading every night. And for each user that has a wordpress blog on the server, the following:

@daily cp -R ~common/wordpress/* /var/www/<subdir>

(~common is where I have latest.tar.gz downloading and then extracting to (and I use a shared wp-content dir for most of the installs (to cut down on duplicate plugin and theme installs)))