4 Compelling Reasons Why WordPress is Secure

As of now, the WordPress content management system (CMS) dominates the web. In fact, WordPress powers 35% of the worldwide web, which is pretty impressive seeing as there are over 1.7 billion websites online right now. The thing is, many people will claim that WordPress is insecure. After all, according to Sucuri, a leading website security and protection platform designed to thwart all cybercrime, claims that WordPress is the most infected CMS of all. But does that mean WordPress shouldn’t be trusted? As the leading content management system in the world, it makes sense that cybercriminals would target it. And with so many websites using it, it also makes sense that the most hacks would be associated with WordPress. That’s[…]

WordPress 5.3.1 is a security and maintenance release that has 46 fixes and enhancements. And even better, it fixes serval security problems found by the following people: Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API. Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links. WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute. Nguyen The Duc for discovering a stored XSS vulnerability using block editor content. Do a free scan at wpsec.com to check if your WordPress installation is safe.  

WPSec.com, Our WordPress Vulnerability Security Scanner has been updated with new functionality and reliability changes. Detect WAF – If there is a scanning problem such as a timeout, we will try to detect if there is a Web Application Firewall (WAF) blocking us. And if there is we will notify you via E-mail or on the web. Timeout detection – If there is a timeout we will now notify you. And we will skip the current scan and do the next one in the schedule and also do a WAF-scan. No plugins found – If we can’t find any plugins we will now notify you. Also we will run a WAF-scan to see if the problem might be related to[…]

Even if WordPress 5.3 isn’t a security release there are still some interesting new security related updates in this version. Trusted CA Bundle Update The root CA bundle has been updated with new CA:s and some removed. The downside is thought that there is still some 1024 bit RSA CA certificates still in the bundle due to backward compatibility. The new CA bundle file can be viewed here. CA bundle is a file that contains root and intermediate certificates. The end-entity certificate along with a CA bundle constitutes the certificate chain and used when WordPress creates outgoing https-connections, such as automatic updates. Let’s hope that WordPress will be using a project like certainty in the future. Secure oEmbeds The list[…]

WordPress 5.2.4 is now available, it’s a short-cycle security release. The next major release will be version 5.3. This security release fixes six security issues. WordPress versions 5.2.3 and earlier are affected by these security bugs, which are fixed in version 5.2.4. There are also security updates to WordPress 5.1 and earlier. List of Security Fixes Ben Bidner of the WordPress Security Team who discovered issues related to referrer validation in the admin. Evan Ricafort for finding an issue where stored XSS (cross-site scripting) could be added via the Customizer. J.D. Grimes who found and disclosed a method of viewing unauthenticated posts. Weston Ruter for finding a way to create a stored XSS to inject Javascript into style tags. David Newman for highlighting[…]

WordPress 5.2.3 has now been released. This is a security and maintenance release features 29 fixes and enhancements and adds several security fixes. These bugs affect WordPress versions 5.2.2 and earlier; version 5.2.3 fixes them, so we recommend all WordPress-users to upgrade. If you haven’t yet updated to 5.2 yet, there are also updated versions of 5.0 and earlier that fix the bugs for you. Security Updates Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments. Props to Tim Coen for disclosing an issue where validation and sanitization of a URL could lead to an open redirect.[…]

WordPress XML-RPC

What is XML-RPC? According to Wikipedia, XML-RPC is a remote procedure call (RPC) protocol which uses XML to encode its calls and HTTP as a transport mechanism. WordPress utilizes this XML-RPC that is used to exchange information between computer systems over a network. In short, it is a system that allows you to post on your WordPress blog using popular weblog clients like Windows Live Writer or using the WordPress mobile app. It is also needed if you want to make connections to services like IFTTT. Pretty damn useful, if you think about it. But that comes at the cost of security risks. Is my WordPress affected ? In the past, there were security concerns with XML-RPC thus it was disabled by default. However Since WordPress 3.5.x, WordPress has had XML-RPC enabled[…]

When it comes to complex password cracking, hashcat is the tool which comes into role as it is the well-known password cracking tool freely available on the internet. The passwords can be any form or hashes like SHA, MD5, WHIRLPOOL etc. Hashes does not allow a user to decrypt data with a specific key as other encryption techniques allow a user to decrypt the passwords. Hashcat uses certain techniques like dictionary, hybrid attack or rather it can be the brute-force technique as well. This article gives an example of usage of hashcat that how it can be used to crack complex passwords of WordPress. Hashcat in an inbuilt tool in Kali Linux which can be used for this purpose. USAGE[…]


Since a few weeks we offer an API so you can get notified about new found vulnerabilities on your WordPress website. The first part of our API are outgoing JSON webhooks. Using webhooks you can integrate against other third party services like Slack and Zapier. The hooks is formatted as JSON, example: { “email”: “[email protected]”, “name”: “WPScans”, “reportURL”: “https://wpsec.com/scan/?id=b8af78jrhj2kjfdef33j3j3j”, “status”: “vuln”, “type”: “scan”, “url”: “http://wpsec.com” } Most of the fields are self-explaining. The status field can be no-wordpress, vuln or no-vuln. The fields being sent are: type name reportURL url email status Screenshot from the Dashboard: This new API is available to Premium Subscribers and is still in beta.