WordPress Blogs at Risk Due to Plug-In Flaw

A security flaw in the default configuration of a popular plug-in for WordPress has put blogs hosted on the platform at risk of data theft.

The flaw, discovered by researcher Jason Donenfeld, is in W3 Total Cache (W3TC), a plug-in to the blog-hosting platform that caches content in order to speed up request times.

Since data are stored similarly and in searchable form, Donenfeld says it’s possible to extract sensitive information like password hashes and database cache keys from any directory that has been enabled.

Even directories that aren’t enabled wouldn’t be very difficult to guess, a Seclist.org post on the matter said.

At present, all versions of WordPress are vulnerable to the flaw, but a later post by Donenfeld said the author of the plug-in plans to close the gap soon. W3TC users are encouraged to disable the plug-in until such a fix is released.

WordPress is an extremely popular platform for hosting both personal and professional blogs.

Image courtesy of Flickr, theanthonyryan

This article originally published at TechNewsDaily here

source : http://mashable.com/2013/01/01/plug-in-flaw-wordpress/


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s