2 ms·
So far, the vulnerable sites under these new attacks are those running WordPress plugins such as Insert PHP and Exec-PHP, which allow visitors to custom
by geerlingguy 10y ago
So far, the vulnerable sites under these new attacks are those
running WordPress plugins such as Insert PHP and Exec-PHP, which
allow visitors to customize posts by inserting PHP-based code
directly into them.
This is never a good idea. Don't allow your content admins to add executable code to a CMS!
- technologyvault 10y agoI'd guess that it was hackers who would even think about creating those plugins in the first place.
- 234dd57d2c8dba 10y agoIt's a tradeoff, people have to get stuff done ya know. Proper authentication and authorization controls would have been a better choice.