Are the developers of WordPress avoiding security by obscurity or there some reason to expose plugin and login names?

Tools like wpscan are out there in the open, which make the scanning of any WordPress website plugins without any authentication and receive sensitive data like wp-admin login names (which usually contain PII), plugins used, etc.

Is this… Continue reading Are the developers of WordPress avoiding security by obscurity or there some reason to expose plugin and login names?

WordPress and Apache Struts weaponized vulnerabilities on the rise

Vulnerabilities in leading web and application frameworks, if exploited, can have devastating effects like the Equifax breach which affected 147 million people, according to RiskSense. Among the report’s key findings, total framework vulnerabilities in… Continue reading WordPress and Apache Struts weaponized vulnerabilities on the rise

Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine?

I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. When I went to finish the install after le… Continue reading Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine?