WordPress Plug-in Updated in Rare Forced Action

The security team at WordPress has taken advantage of a powerful, but rarely used, feature in the content management platform to force an update to a popular plug-in across the entire user base. Loginizer, with more than a million installations, was updated after researchers found a critical vulnerability that could have allowed an attacker to take control of a site through SQL injection techniques.

Loginizer is a popular plug-in that provides login and authentication security for websites built on WordPress. According to an article on ZDNet, the vulnerability meant an attacker could include SQL code in an attempted user name. While the fake user name would be rejected, Loginizer would store it in the WordPress database, where it could be executed and provide site access to the attacker.

According to W3Techs, WordPress is the foundation of 38.6% of all websites.

"Given the critical risk of the vulnerability and the ease of exploitation, unpatched plug-ins are a major risk not only for careless website owners, but for the integrity of their website visitors, whose confidential data and PII may be stolen and then sold or exploited," says Ilia Kolochenko, founder and CEO of ImmuniWeb.

Even so, many WordPress site administrators complained about the forced update.

"As WordPress also found out, many site admins don't like forced updates, primarily due to the possibility that when they fix one security issue, they might break something else in the site," explains Jayant Shukla, CTO and co-founder of K2 Cyber Security. 

In an update to the ZDNet article, Logonizer's developers report that 89% of all sites using the plug-in have been upgraded due to the forced update.

Read more here.