Was your site hacked recently?
Following the routine security activity and the tracking of security vulnerabilities that we at uPress carry out proactively,
We encountered a number of inquiries regarding for injecting content (usually as posts) via the REST API protocol of WordPress.
This security vulnerability allows to unauthenticated users (without logging in with a username and password) to edit the content of any of the pages or posts within WordPress sites.
A fix for this security vulnerability is included quietly in WordPress in version 4.7.2 along with several less severe security issues.
This version was released deliberately, without any publicity regarding the security vulnerability, in order to give users enough time to update their WordPress version.
Now, when enough time has passed, the security vulnerability was published on a number of blogs around the world, including on the official WordPress website.
How can I know whether I am at risk?
The security vulnerability affects the WordPress REST API, which was recently added and enabled by default – in WordPress version 4.7.0.
One of the REST API endpoints allows viewing, editing, deleting, and creating posts (by interfacing through the API).
At this specific point, the security vulnerability allows visitors to edit any of the posts on the site without permission verification.
The security vulnerability affects all WordPress sites in versions 4.7.0 or 4.7.1. If your site is on one of these versions – you are indeed exposed to the security vulnerability.
In summary
If you have not yet enabled automatic updates on your WordPress site, It's time to update as soon as possible!
This is a very serious security vulnerability that can be used by attackers around the world, in various ways, to use your site for malicious purposes. Update immediately!
