PSA WordPress Core had Critical Vulnerability. Patch released on Friday. Immediately update (slcyber.io)
from sanitation@lemmy.today to selfhosted@lemmy.world on 23 Jul 10:10
https://lemmy.today/post/57057241

7.0.2 got released on Friday. Exploits are already happening. People reporting hacks

#selfhosted

threaded - newest

ThanksObama@sh.itjust.works on 23 Jul 11:46 next collapse

Correction: WordPress IS a critical vulnerability.

Marthirial@lemmy.world on 23 Jul 13:19 next collapse

I have developed and hosted over 760 WP sites since 2006 and have never been hacked. Ever.

Mediocre craftspeople blame their tools.

loo@lemmy.world on 23 Jul 13:39 next collapse

Glad you got lucky. But a tool having one critical vulnerability after another has nothing to do with mediocre craftsmanship and blaming admins for getting hacked after updating their software is nothing but disrespectful and condescending

kungen@feddit.nu on 23 Jul 14:45 next collapse

I’ve driven a poorly designed car without many safety features for years, and I’ve never flown through the windshield, ever.

genzboomer@lemmy.zip on 23 Jul 17:49 next collapse

Professionals are never cocky. Cocky comes back to bite.

LunarLoony@lemmy.sdf.org on 23 Jul 19:49 collapse

How do you know?

9point6@lemmy.world on 23 Jul 14:11 next collapse

www.wordfence.com/threat-intel/vulnerabilities

The CVE list always cracks me up, there’s like tens daily

chronicledmonocle@lemmy.world on 23 Jul 22:26 collapse

JFC I thought you were exaggerating.

SreudianFlip@sh.itjust.works on 23 Jul 16:28 next collapse

Anyone who hosts websites can check the logs and see the bots hammering away at wp/admin primarily, even if you are not running any WordPress. Low hanging meat? Fresh fruit?

ctenidium@lemmy.world on 24 Jul 14:59 collapse

Elementor makes it worse though.

lIlIlIlIlIlIl@lemmy.world on 23 Jul 13:02 next collapse

It’s time to ditch WP if you haven’t already

non_burglar@lemmy.world on 23 Jul 13:36 collapse

It was time in 2013.

kohlenstoff@feddit.org on 24 Jul 13:19 collapse

What would you recommend as an alternative for the non-technical inclined users who want to have a public website?

non_burglar@lemmy.world on 24 Jul 14:03 collapse

Is this a trick question?

Websites are complicated. Easy, secure, cheap: pick two. There is no such thing as a universally easy, secure and cheap solution, or else we would always be using it.

Assuming you want secure and easy, I would suggest you pay someone who knows what they’re doing.

kohlenstoff@feddit.org on 24 Jul 16:29 collapse

No, not a trick question at all.

I know what I am doing but people I work for do not, therefore my question for an alternative where these people can write text on a simple website in a WYSIWYG editor. Going by your comment you haven’t found one either which makes WP sadly the only option for this specific use case.

CausticFlames@sopuli.xyz on 23 Jul 15:08 next collapse

Friendly reminder to anyone who cares enough that you can still use WordPress to make your site with all your fancy plugins and layouts, and then export that to a static site for hosting. No need to actually host Wordpress itself that way you avoid nearly all of this BS.

LunarLoony@lemmy.sdf.org on 23 Jul 19:50 next collapse

Not a bad idea. How would one do this?

CausticFlames@sopuli.xyz on 23 Jul 22:15 collapse

Simply Static is currently the most actively maintained solution, as a plugin for wp:
docs.simplystatic.com/category/6-user-guides

There is also WP2Static, which is a very long standing project: github.com/elementor/wp2static

yuman@programming.dev on 24 Jul 07:27 collapse

this thing here. I’ve dramatically reduced support work at two shops I’ve set this up for. incidents went from from coupla times a month to once a year. not to mention - you don’t need no VPS no more, don’t need no database, nothing, the simplest web hosting will do and it’s very cache friendly.

xzinik@feddit.cl on 23 Jul 20:47 collapse

thank god i was able to convince my boss to let go the old wordpress site and only serve static pages when he wanted to have a brand new design, its been about 2months with the new design