Earlier this week WordPress 4.4.2 was released. A new security and maintenance patch for version 4.4.2. All WordPress 4.4.1 and earlier websites are strongly recommended to backup the entire website and push the 4.4.2 update immediately. Two security issues were found in WordPress 4.4.1 and earlier. We’d like to discuss the two vulnerabilities in more detail for educational purposes.

The two attacks were a Server Side Request Forgery (SSRF) for certain local URIs and an open redirection attack.

A SSRF is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server. In layman’s terms, an attacker can use SSRF to access the internal system that is not accessible from the outside world. This allows potential attackers to gain access to sensitive information stored on the website.You can see why WordPress wanted all of its websites to update immediately.

The second vulnerability, an open redirection attack, would allow an attacker to redirect the website to another source. For example, if a website is attacked with an open redirect, the website would take the user to another website. A good example is someone who redirects users who are going to destination A, but decides to take the users to destination B. Destination B can be numerous end points. From a program that installs malicious software to the computer being hijacked and requesting one’s credit card. The end game is not ideal for the non-savvy technical individual.

In addition to the WordPress 4.4.2 release plugging two major security holes, the update resolved 17 bugs from version 4.4 and 4.4.1. Feel free to browse the 17 WordPress bug fixes on the official website.

Highly recommended all WordPress website’s stay up to date with the latest releases. We discussed in another blog the importance of having all WordPress components updated. A good read about why it’s important to keep WordPress updated and how you can prevent malicious attacks to a WordPress website.