Today is a spooky day for WordPress, releasing a new security fix directly related to the last vulnerability fixed in 4.8.2.
Anthony Ferrara warned the security team on 19th september and was very patient until his ticket was closed with no more answers than “non documented functionality is non documented”.
Anthony wrote 2 perfect posts related to the technical side of the flaw and another from the background of it.
So, I won’t write my own this time because these posts are just perfect. Enjoy.
Disclosure: WordPress WPDB SQL Injection – Technical
This post will detail the technical vulnerability as well as how to mitigate it. There is another post which deals with the background and time-lines.
https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-technical.html
Disclosure: WordPress WPDB SQL Injection – Background
This post will detail the background on the vulnerability as well as why I publicly threatened to Fully Disclose. There is another post which deals with the technical vulnerability.
https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-background.html
