Posts Tagged: forced

Millions of WordPress sites receive forced patch for critical plugin flaw

Millions of WordPress sites have received a forced patch over the past few days, Ars Technica has reported. The reason is a vulnerability in UpdraftPlus, a popular plugin that allows users to create and restore website backups. UpdraftPlus developers requested the mandatory patch, as the vulnerability would allow anyone with an account to download a website's entire database. 

The bug was discovered by Jetpack security researcher Marc Montpas during a security audit of the plugin. "This bug is pretty easy to exploit, with some very bad outcomes if it does get exploited," he told Ars Technica. "It made it possible for low-privilege users to download a site's backups, which include raw database backups." 

He told UpdraftPlus developers about the bug on Tuesday last week, they fixed it a day later and started force-installing the patch shortly after that. 1.7 million sites had received it as of Thursday, out of 3 million-plus users.

The main flaw was that UpdraftPlus didn't correctly implement WordPress's "hearbeat' function by properly checking to see if users had administrative privileges. Another issue was a variable used to validate admins that could be modified by untrusted users. Jetpack provided more details about how a hack could work in a blog post.

WordPress was previously breached earlier this year, but it was done indirectly via a GoDaddy hack that exposed 1.2 million accounts. If you're running WordPress with the UpdraftPlus plugin, you should definitely confirm that the plugin updated automatically to 1.22.4 or later on the free version, or 2.22.4 and up on the premium app. 

Engadget is a web magazine with obsessive daily coverage of everything new in gadgets and consumer electronics

Sonos is missing out on the forced YouTube Music conversion

Google’s YouTube Music transition from Google Play Music has been bumpy at best. YouTube Music still isn’t the best streaming service on the block and still hasn’t fully replicated GPM’s features, and a big one that’s missing is annoying Sonos owners. No YouTube Music on Sonos See, Sonos uses its own streaming protocol, not the […]

Come comment on this article: Sonos is missing out on the forced YouTube Music conversion

Visit TalkAndroid


TalkAndroid

OnePlus is testing forced dark mode for more apps in their latest OxygenOS beta

Dark mode is a big deal for Android users. It was a primary selling point with Android 10, and tons of apps and developers have been quickly trying to support that new native dark theme. But not all apps have taken advantage of Android’s native dark mode. Lots of apps are lagging behind, with some […]

Come comment on this article: OnePlus is testing forced dark mode for more apps in their latest OxygenOS beta

Visit TalkAndroid


TalkAndroid

A VR film forced me to confront my fear of the sea

The first time I realized I was terrified of whales, I was surprised. I had been scrolling through Instagram and saw a picture of a boat adrift in the ocean with the gigantic shadow of a whale below it. The hairs on the back of my neck stood, and I w…
Engadget RSS Feed