WordPress is one of the most popular content management systems for this reason is a privileged target of hackers. It is quite easy to scan the web searching for websites running old version affected by known vulnerabilities that could be exploited for various illegal activities.
WordPress is spending a significant effort in securing its CMS, in April it issued several updates.
WordPress has recently issued the version 4.5.3 that patches more than two dozen vulnerabilities, including 17 bugs introduced in the last three releases. Many of the vulnerabilities can be exploited remotely and allow an attacker to control of a website running on WordPress.
“WordPress 4.5.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.” states WordPress.
Some of the flaws could be exploited by attackers to remotely gain complete control of the vulnerable WordPress.
The last update issued by WordPress addressed a redirect bypass vulnerability in WordPress customizer API, two cross-site scripting flaws, an information disclosure bug in the revision history, a flaw that allows for unauthorized category removal from a post, and a denial-of-service issue the oEmbed protocol implemented by WordPress CMS to display embedded photos or video when users link third-party content.
Other vulnerabilities include a password vulnerability via stolen cookies and some less secure sanitize_file_name edge cases.
Websites that support automatic background updates are already beginning to update to WordPress 4.5.3, otherwise you can download it manual form Download WordPress 4.5.3.
(Security Affairs – WordPress 4.5.3 , hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.