Is Your WordPress Site In Danger?

iThemes is a Wordpress plugin development company, with particular focus on security. In fact we use their security plugin as part of our security package.

They also monitor plugins and themes for vulnerabilities and have been instrumental in notifying webmasters of the possible dangers that have been found.

Freemius is like a marketplace for Wordpress Developers, where they can sell premium or free versions of their plugin. Freemius then takes care of the payment processing and licensing of the plugins, as required.

The Freemius Framework is what the plugins use to communicate to the Freemius platform to ensure anyone using the plugin, has the right authorisation to do so.

The problem is with plugins that haven't update to the latest version of the framework, leaving themselves open to what's known as a CSRF attack, via AJAX calls. In this case essentially an attacker could gain access to log files or initiate debug mode.

If your website is not using the Wordpress framework then you are clear (at least from this vulnerability!).

If you do have a Wordpress website then you need to compare the plugins and themes that you have installed (even if deactivated) with the list of affected plugins and themes that can be found here - https://ithemes.com/blog/wordpress-vulnerability-report-march-2-2022/#400-plugins-themes-impacted-by-insecure-freemius-version.

If you find a match and you're not on the version indicated as having a fix, then you have a problem! Either update the plugin, if available, or change to an alternative plugin not listed. If both these options are unavailable to you then make sure you have a security plugin in place and regular backups to try and limit the potential risk or damage from any attack, should it arrive!

Hackers are always looking for weaknesses in plugins and themes. You may have plugins that are up to date but carry a risk of attack, it's simply not been discovered yet, so the simple answer is yes, the discovery of vulnerabilities will happen again.

It is the responsibility of the plugin author to ensure they are keeping their plugin code clean, secure and up to date with latest standards but that doesn't mean they always are. When deciding on which plugin to install on your site, always check the last update date. Anything over 6 months may indicate the plugin is no longer being managed and could, therefore, become a risk to your site. Be sure the plugin developer is active and responsive to support, before using their plugin.

The best way to protect your site is to take out our support package and let us manage your site for you. See what we cover here.

If you'd like to manage it yourself then make sure you have a security plugin installed and configured - we recommend iThemes Security Pro - along with a regular backup schedule in place, so should disaster strike you can return your site to normality quickly!.