Comments on: Bad WordPress hole found https://www.epanorama.net/blog/2014/11/24/bad-wordpress-hole-found/ All about electronics and circuit design Thu, 09 Apr 2026 15:47:07 +0000 hourly 1 http://wordpress.org/?v=3.9.14 By: Tomi Engdahl https://www.epanorama.net/blog/2014/11/24/bad-wordpress-hole-found/comment-page-1/#comment-1299486 Mon, 24 Nov 2014 17:33:08 +0000 http://www.epanorama.net/newepa/?p=28574#comment-1299486 Four-year-old comment security bug affects 86 percent of WordPress sites
Bug allows script attack that could be used to hijack sites or attack visitors.
http://arstechnica.com/security/2014/11/four-year-old-comment-security-bug-affects-86-percent-of-wordpress-sites/

A Finnish IT company has uncovered a bug in WordPress 3 sites that could be used to launch a wide variety of malicious script-based attacks on site visitors’ browsers. Based on current WordPress usage statistics, the vulnerability could affect up to 86 percent of existing WordPress-powered sites.

The vulnerability, discovered by Jouko Pynnonen of Klikki Oy, allows an attacker to craft a comment on a blog post that includes malicious JavaScript code. On sites that allow comments without authentication—the default setting for WordPress—this could allow anyone to post malicious scripts within comments that could target site visitors or administrators.

]]>