Wordpress 0day xploit comment2shell - Not sure why so many people still on wordpress...

[justmeseo]

This github went available not long ago, it has been updated just 12 hours ago https://github.com/DeathShotXD/Comment2Shell it targets most of the wordpress sites out there whatsout if you are in any of this versions.

WordPress Branch	Vulnerable Versions	Fixed Version
7.1	7.1	7.1.1
7.0	7.0–7.0.4	7.0.5
6.9	6.9–6.9.7	6.9.8
6.8	6.8–6.8.8	6.8.9
6.7	6.7–6.7.7	6.7.8
6.6	6.6–6.6.7	6.6.8
6.5	6.5–6.5.10	6.5.11
6.4	6.4–6.4.10	6.4.11
6.3	6.3–6.3.10	6.3.11
6.2	6.2–6.2.11	6.2.12
6.1	6.1–6.1.12	6.1.13
6.0	6.0–6.0.14	6.0.15
5.9	5.9–5.9.16	5.9.17
5.8	5.8–5.8.15	5.8.16
5.7	5.7–5.7.17	5.7.18
5.6	5.6–5.6.19	5.6.20
5.5	5.5–5.5.20	5.5.21
5.4	5.4–5.4.21	5.4.22
5.3	5.3–5.3.23	5.3.24
5.2	5.2–5.2.26	5.2.27
5.1	5.1–5.1.24	5.1.25
5.0	5.0–5.0.27	5.0.28
4.9	4.9–4.9.31	4.9.32
4.8	4.8–4.8.30	4.8.31
4.7	4.7–4.7.35	4.7.36

 

[justmeseo]

thanks for moving the post to the right place.

 

[IM Dude]

7.1.2 is already out bytheway

 

[justmeseo]

7.1.2 is already out bytheway

You are absolutely right, just searched it, and it got release 3 days ago...

 

[Starblazer]

Most people install WordPress and abandon the sites for several months without any maintenance. This exploit is going to be in News for some time.

 

[justmeseo]

Most people install WordPress and abandon the sites for several months without any maintenance. This exploit is going to be in News for some time.

I agree, everyday a new plugin, new theme with more defects.

 

[TheMarquis]

If you update your WordPress site(s) often, there are small chances to get in trouble.

 

[B1TCS]

Not sure why so many people still on wordpress..

because most people are used to it, until something better comes it will keep being the most used CMS

 

[justmeseo]

If you update your WordPress site(s) often, there are small chances to get in trouble.

its true, the question is do everyone does that ?

because most people are used to it, until something better comes it will keep being the most used CMS

Indeed, I dont think nothing will be able to replace it.

 

[software_ninja]

This github went available not long ago, it has been updated just 12 hours ago https://github.com/DeathShotXD/Comment2Shell it targets most of the wordpress sites out there whatsout if you are in any of this versions.

WordPress Branch	Vulnerable Versions	Fixed Version
7.1	7.1	7.1.1
7.0	7.0–7.0.4	7.0.5
6.9	6.9–6.9.7	6.9.8
6.8	6.8–6.8.8	6.8.9
6.7	6.7–6.7.7	6.7.8
6.6	6.6–6.6.7	6.6.8
6.5	6.5–6.5.10	6.5.11
6.4	6.4–6.4.10	6.4.11
6.3	6.3–6.3.10	6.3.11
6.2	6.2–6.2.11	6.2.12
6.1	6.1–6.1.12	6.1.13
6.0	6.0–6.0.14	6.0.15
5.9	5.9–5.9.16	5.9.17
5.8	5.8–5.8.15	5.8.16
5.7	5.7–5.7.17	5.7.18
5.6	5.6–5.6.19	5.6.20
5.5	5.5–5.5.20	5.5.21
5.4	5.4–5.4.21	5.4.22
5.3	5.3–5.3.23	5.3.24
5.2	5.2–5.2.26	5.2.27
5.1	5.1–5.1.24	5.1.25
5.0	5.0–5.0.27	5.0.28
4.9	4.9–4.9.31	4.9.32
4.8	4.8–4.8.30	4.8.31
4.7	4.7–4.7.35	4.7.36

yeah, good heads-up. Best thing is to keep wordpress , plugin and themes updated and double check if your version is actually affected.

 

[justmeseo]

yeah, good heads-up. Best thing is to keep wordpress , plugin and themes updated and double check if your version is actually affected.

Exactly, if you could only know how many people that I know got their sites hacked like that, the exploit is incredible and well thought.

 

[Ksatriaseo]

The main move is updating to the latest version and keeping plugins/themes patched.

Most of these exploits hit outdated installs, so staying current and using basic security habits is usually enough to avoid getting caught.