The Real Risk Isn’t the Hack. It’s the Patching Delay
There’s a WordPress plugin flaw today that could let a stranger take over your website. And they don’t even need an account or a password to get in. Hi, I’m Dustin Gray. I’ve been building production software for 25 years, and I look at the security topics that matter every day.
So let’s start with the biggest one today. OttoKit has a serious flaw that could hand a stranger the keys to your website. The flaw lets someone give themselves a level of access they should never have had, and they don’t need an account or a login to do it.
In the worst case, they could make themselves an administrator, which means full control of your website. From there, they could add their own admin users and install plugins, and that’s where it starts to get really bad. They could plant malware, redirect your visitors or get at customer data.
And that reaches the automations OttoKit connects to as well. So if it can’t be updated straight away, at least see if you can switch it off until it is, because the only people with admin access should be the ones you choose.
phpMyFAQ has a flaw that lets a stranger log in as anyone, even your admin. phpMyFAQ is software some businesses use to run their help and FAQ pages. The problem is in how it sets up passkeys, those logins that replace a password.
An attacker can attach their own passkey to someone else’s account. They don’t need the password and they don’t need to log in first. All they need is that person’s username.
So go and check your stack to see if you’re running phpMyFAQ, and if you are, whether it’s on version 4.1.9 or later. A login should prove who you are, not just who you say you are.
Now to a WordPress plugin that runs chatbot forms. A chatbot form plugin for WordPress has a serious flaw that anyone can reach. It’s called Conversational Forms for ChatBot, and it’s made by QuantumCloud.
The plugin accepts specially built data from visitors and trusts it without checking, and an attacker doesn’t need an account or a login to send it. How much harm that does depends on what else is installed on the site. But in the worst case, it can lead to someone taking over the site or its data.
Booktics, a WordPress booking plugin, has a flaw that could let strangers read your database. Booktics is a plugin sites use to take appointments and bookings. The flaw lets an attacker slip their own commands into the plugin’s database requests, and they don’t need an account or a login to do it.
That could expose your bookings and the details of the people who made them. So far, no one has reported an attack using it, but every version up to 1.0.29 is affected.
So if you take bookings on WordPress, go and check whether you’re running Booktics. If you are, check you’re on version 1.0.30 or later, because your customers trusted you with their booking details.
Fastify JWT has a flaw that can keep somebody logged into your app for good. It’s a building block developers use for sign-in on apps built with Fastify. Normally, a sign-in token expires, so an old login stops working.
But in some setups, the plugin quietly drops those expiry rules. So a token can be issued that never expires, and old tokens can still be accepted. There’s no error and no warning when it happens.
So here’s the lesson from today. Every flaw I covered already has a fix. The risk sits in the gap between a fix coming out and your site getting it.
So here’s one question to ask your team this week: how quickly do our plugins and software get updated once a fix is out? If nobody can give you a clear answer, that’s worth having a conversation.