1 min read

Update Your All In One SEO Plugin For Security Patch

Do you own and operate a WordPress website?  Do you also use the “All in One” SEO plugin?

If you answered yes to both of those questions, then be aware that you’ll want to update that plugin as soon as possible.

Recently security researcher Marc Montpas from Automattic Security discovered and reported a pair of critical security flaws.

These flaws put any website using the non-upgraded version of that plugin at risk. The security flaws are being tracked as CVE-2021-25036 and CVE-2021-25037 respectively. The first is an Authenticated Privilege Escalation bug and the second an Authenticated SQL Injection bug.

The bad news is that there are currently more than 800,000 websites running the outdated and vulnerable version of the plugin.  The good news is that the development team behind the All-in-One plugin responded very quickly and delivered an update to their product on December 7th of this year (2021) which addresses both issues.

The reason these flaws are so dangerous lies in the fact that all an attacker needs to be able to successfully execute an attack that leverages them is an authenticated account. That is generally a relatively easy thing to get.  It doesn’t have to have a lot of rights or privileges so a low-level permission group like “Subscriber” is sufficient.

Using that as a starting point it would be easy for an attacker to escalate his or her own privileges and cause all sorts of damage to the site itself or exfiltrate data from it.  Not good.

Now is the Time to Update Your All-in-One SEO Plugin

In any case there’s a simple solution ready and waiting.  Just check to see what version of the All-in-One plugin you’re using. If you don’t already have it download and install the 4.1.5.3 patch.  Stay safe out there.  There may yet be a few additional surprises in store for us in what remains of the year.

Used with permission from Article Aggregator

Hybrid Cloud Strategies: The Next Legal Technology Trend?

Hybrid Cloud Strategies: The Next Legal Technology Trend?

The way legal firms use technology is changing fast. Many have already introduced public cloud tools to enhance everyday communication and...

Read More
Why Small Law Practices Need Structured Compliance Training Tools

Why Small Law Practices Need Structured Compliance Training Tools

When you think about compliance training, does your mind immediately picture massive corporations or those huge law firms with endless rows of desks?

Read More

Update VMWare Apps Now for Critical Security Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory that serves as a stark warning.

Read More

WhatsApp Provides Disappearing Messages Feature to Improve Security

Whatsapp has had a tough year from a security standpoint and has suffered losses in the size of its user base as a result.

Read More

Update Now If You Run This WordPress Plugin

Millions of people around the world have leveraged the awesome power of WordPress to build their sites. Whether for personal or business use,...

Read More