Virally growing attacks on unpatched WordPress sites affects ~2m pages | Hacker News Reader

Virally growing attacks on unpatched WordPress sites affects ~2m pages

arstechnica.com

13 pointsgeerlingguy3 comments

    So far, the vulnerable sites under these new attacks are those
    running WordPress plugins such as Insert PHP and Exec-PHP, which
    allow visitors to customize posts by inserting PHP-based code
    directly into them.

This is never a good idea. Don't allow your content admins to add executable code to a CMS!

I'd guess that it was hackers who would even think about creating those plugins in the first place.

It's a tradeoff, people have to get stuff done ya know. Proper authentication and authorization controls would have been a better choice.

Reply on news.ycombinator.com