Sucuri announced vulnerability on WordPress REST API

• 

  hypergeometric · Member · Feb 1, 2017 at 8:25 pm

  • Copy link
  • Add topic to favorites

  Sucuri just announced a serious vulnerability of their WordPress REST API in versions before 4.7.2.

  Do we, as users of the online WordPress.com facility, have any exposure to this? If so, what steps is WordPress taking to correct this?

  Thanks!

  The blog I need help with is: (visible only to logged in users)

• 

  timethief · Member · Feb 1, 2017 at 9:04 pm

  • Copy link

  When we need Staff help with issues Volunteers cannot resolve like this one we type modlook into the sidebar tags on our forum threads. I did that for you. How do I get a Moderator/Staff reply for my question? https://en.support.wordpress.com/getting-help-in-the-forums/#how-do-i-get-a-moderatorstaff-reply-for-my-question Then we subscribe to this thread so we are notified when they respond. To subscribe look in the sidebar of this thread, find the subscribe to topics link and click it.

• 

  kokkieh · Staff · Feb 2, 2017 at 8:50 am

  • Copy link

  Hi there,

  You are using WordPress.com. WordPress 4.7.2 refers to the self-hosted version of WordPress, called WordPress.org. WordPress.com and WordPress.org are not the same.

  That said, this issue is already being worked on by the WordPress Core team, here:

  Disclosure of Additional Security Fix in WordPress 4.7.2

  That site is the correct place to report bugs or issues with the self-hosted WordPress software.