NerdPress Issue Updates
Current issues
You may have seen news, or received an email from your host, about two serious security vulnerabilities in PHP, the code that runs WordPress. Here’s where things stand.
Because this is a server-level issue, the fix must be applied by your web host, not from inside WordPress.
We’ve been in communication with hosts since this was first announced, and they’re actively rolling out the available patches right now. Most hosts we’ve spoken with started mitigating this even before the official fix...
As far as we’re still aware, the use of Google automated verification system or “wizard” for Google Analytics, Google Search Console, or any other Google product continue to cause issues that can break DNS records.
A new minor version of WordPress core, 7.1.3, was released today with 7 security fixes and 4 bug fixes. The security fixes are being backported as far as WordPress core 4.7.
As a minor security fix, sites are beginning to update to this version automatically – this is expected and what we want to happen. Sites on core 7.1.2 will automatically update to 7.1.3. Sites on 7.0.6 –> 7.0.7. Etc.
Our team will keep an eye on all sites to ensure they update.
WP Rocket had a couple of a security issues reported publicly today. Both issues have been addressed and patched by our team and tools. 😮💨
Data exposure issue
One issue could have exposed account email addresses, license keys, and — on sites where those integrations are set up — Cloudflare and Sucuri API keys. Though most sites are using our WP Rocket license, some still had old data stored in the database.
WP Rocket released a patch for the vulnerability shortly after notified and there...