Attackers can use a public or unsecured wi-fi network, a WordPress-installation, take over, also as tweestapsverificatie is enabled. That has a core developer of the open-source cms confirmed. He says that there is a fix.
An employee of the American equivalent of Bits of Freedom, Electronic Frontier Foundation, discovered that all WordPress installations are vulnerable to hijacking, reports ArsTechnica Monday. That is due to a so-called key cookie, the username and the password unencrypted over the browser sends. It comes to the cookie with the tag “wordpress_logged_in’.
According to the employee, Yan Zhu, can see the cookie intercept if users are using a non-secure connection to log in. She could be the method to reproduce and found out that she was instantly logged in, without her login credentials. Furthermore, it was tweestapsverificatie via the telephone as to be able to be passed through, so she made Thursday all the world.
Zhu was the leak under the name of the blogger posts, private messages, read and view statistics. In addition, they could in its name reactions to writing. Finally, she could the e-mail address that was linked to the account, change. Therefore, the owner of the WordPress installation, its password cannot be changed. Finally, could Zhu the tweestapsverificatie turn on if that was not the case, that the attacker actually done to the user of the site in weert. The change of the password is not possible; for this purpose, a separate cookie is necessary, however, is encrypted.
WordPress lead developer Andrew Nacin confirmed Thursday in a tweet the vulnerability. He said that a patch is planned for the next release, which has not yet been released. Until that time, all WordPress installations are vulnerable, subject to the terms and conditions mentioned for the attack. Zhu recommends users not to log in over unreliable internet connections.
It is the second time in a short period of time that attackers via cookies can log in on WordPress systems. Last month, crushing the developers have a bug which makes it for an attacker was using fake authentication cookies in WordPress. The early version of 3.9, version 3.8, and 3.7 were vulnerable.
Comments
(41)