{"id":160692,"date":"2024-05-20T10:33:06","date_gmt":"2024-05-20T09:33:06","guid":{"rendered":"https:\/\/getshieldsecurity.com\/?p=160692"},"modified":"2024-05-20T10:33:07","modified_gmt":"2024-05-20T09:33:07","slug":"shieldnotes-ep14","status":"publish","type":"post","link":"https:\/\/getshieldsecurity.com\/blog\/shieldnotes-ep14\/","title":{"rendered":"ShieldNOTES Ep#14: ACF & JetPack Vulnerabilities, Japanese Keyword Hack from our Blog, & SSH Security"},"content":{"rendered":"\n

There are many new vulnerabilities out there this week, including JetPack and Advanced Custom Fields.<\/p>\n\n\n\n

#1 – Vulnerable: Advanced Custom Field PRO<\/h2>\n\n\n\n

With 2+ million installations for the free version, many will be running the Pro edition.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v6.2.10+<\/p>\n\n\n\n

What’s the risk?<\/strong>
Severity risk 9.9\/10 – risk of local file inclusion!<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#2 – Vulnerable: Elementor \u2013 Header, Footer & Blocks Templates<\/h2>\n\n\n\n

1+ million installations so many Elementor fans will be using this.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v 1.6.29+<\/p>\n\n\n\n

What’s the risk?<\/strong>
XSS allowing injection of malicious scripts into website that guests may execute.<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#3 – Vulnerable: JetPack<\/h2>\n\n\n\n

Not the most severe, but huge installation base.<\/p>\n\n\n\n

How will I know I’m okay?<\/strong>
Upgrade ASAP to v 13.3.1+<\/p>\n\n\n\n

What’s the risk?<\/strong>
XSS allowing injection of malicious scripts into website that guests may execute.<\/p>\n\n\n\n

Editor Comment<\/strong>
Please use ShieldPRO’s auto-upgrade feature<\/a> for vulnerable plugins.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#4 – From our blog: Japanese Keyword Hack Primer<\/h2>\n\n\n\n

This article outlines the principles of the Japanese keyword hack and how you might spot it, and mitigate it.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

#5 – Server Root SSH Access For Sale<\/h2>\n\n\n\n

This article demonstrates that security at all levels of your WordPress infrastructure is critical. If you regularly access your server over SSH, make sure you’re not re-using passwords, and you’re using the latest versions of your SSH client.<\/p>\n\n\n\n

Keys & Certificates over Passwords<\/strong>
If you’re using passwords to access your servers via SSH, consider switching to Public\/Private Keys, or even Certificates – far more secure and versatile.<\/p>\n\n\n\n

More Info \u2192<\/a><\/p>\n\n\n\n

Thanks for reading, and have a great week!<\/p>\n\n\n\n

Paul Goodchild<\/strong>
Shield Security for WordPress<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

There are many new vulnerabilities out there this week, including JetPack and Advanced Custom Fields.<\/p>\n","protected":false},"author":27,"featured_media":157238,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,153,201],"tags":[69],"class_list":["post-160692","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-security-wordpress-solutions","category-shieldnotes","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/160692","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/comments?post=160692"}],"version-history":[{"count":2,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/160692\/revisions"}],"predecessor-version":[{"id":160694,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/posts\/160692\/revisions\/160694"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media\/157238"}],"wp:attachment":[{"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/media?parent=160692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/categories?post=160692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getshieldsecurity.com\/wp-json\/wp\/v2\/tags?post=160692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}