An Error Occurred in the Upload. Please Try Again Later. Wordpress 4.5.3

Critical Vulnerability Detected in WooCommerce on July 13, 2021 – What You Need to Know

Written by Beau Lebens on July 15, 2021 Blog.

Concluding Updated: July 23, 2021

On July 13, 2021, a critical vulnerability concerning WooCommerce and the WooCommerce Blocks feature plugin was identified and responsibly disclosed by security researcher Josh, via our HackerOne security plan.

Upon learning nigh the result, our team immediately conducted a thorough investigation, audited all related codebases, and created a patch to set up the outcome for every impacted version (ninety+ releases) which was deployed automatically to vulnerable stores.

I take a WooCommerce store – what actions should I take?

Automated software updates to WooCommerce 5.5.1 began rolling out on July fourteen, 2021, to all stores running impacted versions of each plugin, but we notwithstanding highly recommend you ensure that yous're using the latest version. For WooCommerce, this is 5.5.two* or the highest number possible in your release branch. If y'all're besides running WooCommerce Blocks, you should be using version 5.5.1 of that plugin.

Important : With the release of WooCommerce 5.five.ii on July 23, 2021, the automobile-update process mentioned above has been discontinued.

After updating to a patched version, nosotros besides recommend:

• Updating the passwords for any Admin users on your site, peculiarly if they reuse the aforementioned passwords on multiple websites
• Rotating any Payment Gateway and WooCommerce API keys used on your site.

There'southward more data about these steps beneath.

* WooCommerce 5.v.ii was released on July 23, 2021. The fixes independent in this version are unrelated to the recent security vulnerability.

How practise I know if my version is upward-to-appointment?

The table beneath contains the full list of patched versions for both WooCommerce and WooCommerce Blocks. If you are running a version of WooCommerce or WooCommerce Blocks that is not on this list, please update immediately to the highest version in your release branch.

Patched WooCommerce versions	Patched WooCommerce Blocks versions
three.3.half dozen	ii.5.16
3.iv.8	2.6.2
3.5.ix	2.7.2
3.vi.vi	2.viii.i
3.7.ii	2.9.1
iii.8.2	iii.0.1
3.nine.four	iii.one.1
iv.0.2	3.ii.1
4.1.2	three.iii.1
4.2.3	iii.4.1
4.3.4	3.5.1
4.iv.2	3.6.1
4.5.3	3.7.two
4.6.3	3.8.one
four.7.2	three.ix.1
4.viii.1	4.0.1
4.9.3	four.1.one
5.0.i	4.two.one
5.i.1	4.3.1
5.ii.3	4.four.3
5.three.1	4.5.3
five.iv.2	iv.6.1
5.five.one	4.7.i
5.5.2	4.8.1
	4.9.two
	5.0.1
	5.1.ane
	5.2.i
	5.3.2
	v.4.one
	5.5.1

Why didn't my website get the automatic update?

Your site may not have automatically updated for a number of reasons, a few of the well-nigh likely are: you're running a version prior to one impacted (below WooCommerce 3.3), automatic updates take been explicitly disabled on your site, your filesystem is read-only, or there are potentially conflicting extensions preventing the update.

In all cases (except the first case, where you lot are unaffected), y'all should try to manually update to the newest patched version on your release branch (e.g. v.five.ii, 5.4.2, five.3.one, etc), every bit listed in the table in a higher place.

Has whatsoever data been compromised?

Based on the electric current bachelor prove we believe whatsoever exploit was limited.

If a store was affected, the exposed information will be specific to what that site is storing but could include lodge, client, and authoritative information.

How can I bank check if my store was exploited?

Due to the nature of this vulnerability, and the extremely flexible way that WordPress (and thus WooCommerce) allows spider web requests to be handled, there is no definitive style of confirming an exploit. You lot may be able to find some exploit attempts by reviewing your spider web server's admission logs (or getting help from your spider web host to practise so). Requests in the following formats seen between December 2019 and at present probable indicate an attempted exploit:

• REQUEST_URI matching regular expression /\/wp-json\/wc\/store\/products\/collection-data.*%25252.*/
• REQUEST_URI matching regular expression /.*\/wc\/shop\/products\/drove-data.*%25252.*/ (note that this expression is not efficient/is boring to run in about logging environments)
• Any non-Become (Mail or PUT) request to /wp-json/wc/store/products/drove-data or /?rest_route=/wc/store/products/drove-information

Requests that nosotros have seen exploiting this vulnerability come from the post-obit IP addresses, with over 98% coming from the kickoff in the list. If you lot see any of these IP addresses in your admission logs, you should assume the vulnerability was being exploited:

• 137.116.119.175
• 162.158.78.41
• 103.233.135.21

Which passwords do I need to change?

Information technology'southward unlikely that your password was compromised as information technology is hashed.

WordPress user passwords are hashed using salts, which means the resulting hash value is very difficult to scissure. This salted hash arroyo protects your password as an admin user, and also the passwords of whatever other users on your site, including customers. While information technology is possible the hashed version of your password stored in your database may have been accessed through this vulnerability, the hash value should be indiscernible and still protect your passwords from unauthorized apply.

This assumes that your site is using the standard WordPress countersign management for users.  Depending on the plugins yous've installed on your site you lot may accept passwords or other sensitive information stored in less secure means.

If any of the Administrator users on your site might have reused the same passwords on multiple websites we recommend you update those passwords in case their credentials have been compromised elsewhere.

Nosotros also recommend irresolute any private or underground data stored in your WordPress/WooCommerce database. This may include API keys, public/private keys for payment gateways and more than, depending on your item store configuration.

Every bit an extension developer or service provider, should nosotros alarm our WooCommerce merchants?

If you work with any alive WooCommerce shop or merchant, nosotros encourage you to work with them to make certain they know virtually this outcome, and/or update their store to a secure version.

If yous have congenital an extension or offer a SaaS service that relies on the WooCommerce API, nosotros encourage you to assistance merchants reset the keys to connect to your service.

As a store owner, should I alert my customers?

Whether y'all warning your customers is ultimately up to you. Your obligations to notify customers or reset things like passwords will vary depending on details like your site infrastructure, where yous and your customers are geographically located, what data your site is collecting, and whether or non your site has been compromised.

The most important activity you tin accept to protect your customers is to update your version of WooCommerce to a version that has been patched with a fix for this vulnerability.

After updating, we recommend:

• Updating the passwords for whatever Administrator users on your site, specially if you reuse the same passwords on multiple websites
• Rotating any Payment Gateway and WooCommerce API keys used on your site.

Equally the store owner it is ultimately your determination whether y'all want to take additional precautions such as resetting your customers' passwords. WordPress (and thus WooCommerce) user passwords are hashed using salts, which means the resulting hash value is very difficult to crack. This salted hash arroyo is applied to all user passwords on your site, including your customers' passwords.

Is WooCommerce nonetheless safety to use?

Yeah.

Incidents similar this are uncommon, simply do unfortunately sometimes happen. Our intention is always to respond immediately and operate with complete transparency.

Since learning of the vulnerability, the squad has worked around the clock to ensure that a fix has been put in identify, and our users accept been informed.

Our connected investment in platform security allows u.s. to prevent the vast bulk of issues – but in the rare cases that could potentially impact stores, we strive to ready quickly, communicate proactively, and piece of work collaboratively with the WooCommerce Community.

What if I nevertheless have questions?

If you have any further concerns or questions regarding this issue, our team of Happiness Engineers is on hand to help – open a support ticket.

WooCommerce

The most customizable eCommerce platform for building your online business.

taylorforappou.blogspot.com

Source: https://woocommerce.com/posts/critical-vulnerability-detected-july-2021/

Share this post