Thoughts, information and reflections about technology

WordPress Captcha plugin has a backdoor.

The Wordfence blog posted an article about a WordPress Captcha plugin that has a backdoor. Their post details exactly how the exploit works.

In short, if your site is running the compromised version of this plugin, or any of the other four plugins from the same publisher, then your site can be compromised.

Some steps a site owner can take to prevent and/or mitigate potential hacking are:

  • Keep WordPress updated
  • Keep plugins updated. (See the note below)
  • Minimize the use of third party tools such as plugins. It is impossible to completely avoid third party tools but webmasters should do a risk-benefit analysis before adding any such tools.
  • Use a tool such as Wordfence that provides additional security for your site.
  • Look at your server logs for unusual activity.
  • Subscribe to at least one or two lists that monitor WordPress Security
  • Have rotating backups of your site and data.  ROTATING is the key word. You want to be able to go back to a point in time where the site and data are clean if you are compromised.
  • Encrypt personally identifiable information.
Note – Keeping plugins updates is a best practice. However, in this case, the updates would have had the backdoor.

 

Similar Posts:

Leave a Reply

Your email address will not be published. Required fields are marked *

Contact me
Archives
Categories
Amazon Disclosure

We are a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for us to earn fees by linking to Amazon.com and affiliated sites.