Marcus Couch and I are joined by CrowdFavorite CTO, Chris Lema. We talk about his new position and what the joint-venture partnership means for both CrowdFavorite and iThemes. Lema explains what the word enterprise means for WordPress products and near the end of the show, gives us his prediction on what will happen in the…
The security team at Sucuri publicized a critical vulnerability found in the WordPress Slider Revolution plugin recently. The bug has since been patched, but the development team for Slider Revolution kept silent about it and did not notify their users of the importance of updating. The popular commercial slider plugin is hosted on Codecanyon, an…
In this weeks show, Marcus Couch and I are joined by the founder of BruteProtect, Sam Hotchkiss. We learn the circumstances which lead to the birth of BruteProtect and how it operates. Hotchkiss explains the details of the acquisition with Automattic and how it will be rolled into Jetpack. While some people are not happy…
The past 156 episodes of WordPress Weekly are filled with stories of people who are doing exciting things with WordPress. For this episode, I decided to try something a little different. I handed the show over to Marcus Couch, who interviewed me. In the show, I describe how I became interested in computers and the…
WordPress users are strongly encouraged to update their sites to 3.9.2 as it’s a security focused release. According to the announcement, 3.9.2 fixes a possible denial of service issue in PHP’s XML processing. The bug was first reported by Nir Goldshlager of the Salesforce.com Product Security Team and was fixed by Michael Adams and Andrew…
Pippin Willamson, creator of the AffliateWP plugin, has discovered a serious bug within the All In One WordPress Security and Firewall plugin. According to a forum thread created by Williamson, All In One WordPress Security and Firewall automatically detects option ids with fwp as malicious and deletes them. Known WP Pharma Hack Entry: fwp and…
The JSON REST API plugin for WordPress released a security update over the weekend. Version 1.1.1 includes a fix for a vulnerability wherein the JSONP support built-in to the API could be used to serve up arbitrary Flash SWF files. This technique has been known to be used in the past to abuse JSON endpoints…
First reported by Sucuri, the WPTouch plugin has a dangerous security vulnerability and users are encouraged to update immediately. WPTouch is used to quickly add mobile support to websites and has over 5 million downloads making it one of the most popular plugins in the WordPress plugin directory. According to Sucuri, WPTouch incorrectly uses…
The security research team at Sucuri has discovered a vulnerability in the popular WordPress MailPoet Plugin, formerly known as WYSIJA Newsletters. The bug leaves MailPoet open to an attack wherein a file can be uploaded remotely without authentication. Sucuri is classifying this as a serious vulnerability and recommends an immediate update for anyone using the…
The developers of Pods, a popular WordPress plugin used to create and extend custom post types, content types, taxonomies, users, media, or comments, has released an update that addresses a critical security vulnerability. Version 2.4.3 and all previous versions of the plugin have been patched in case you can’t upgrade to the latest version immediately.…
Security vulnerabilities have plagued the TimThumb script for years. It is most commonly used in cropping, zooming and resizing images in WordPress themes. After the large scale attacks launched against the script a few years ago, one might think that theme and plugin developers would be less likely to continue building with it. However, this…
Clef, the two-step authentication service that replaces usernames and passwords has announced a strategic partnership with Softaculous. Softaculous is similar to Fantastico in that it contains several scripts that can be auto installed on a webhosting account. The partnership enables automated WordPress installs from Softaculous to have Clef support out of the box. In one…
If you have a WordPress site with a bbPress-powered forum, you may want to set aside a few minutes this weekend to perform updates. bbPress 2.5.4 was released today with five bug fixes, including an important fix for a security vulnerability. bbPress project lead John James Jacoby announced the release, crediting IT Security Reaseacher Mazen…
The popular All In One SEO Plugin for WordPress has released an update addressing two security issues discovered by Sucuri during a security audit. According to Sucuri, one of the vulnerabilities can be used to escalate privileges while the other deals with Cross Site Scripting attacks. A logged-in user who doesn’t have administrative capabilities is…
We started the show off with Andrew Nacin where he clarified a number of points dealing with the WordPress.com Cookie problem. He also published a great post explaining why security is nuanced. The second part of the show featured an interview with Varsity News Network CEO, Ryan Vaughn, to discuss how the company is utilizing…