A free weekly Newsletter with a round-up of WordPress news and articles
WordPress REST API Vulnerability is Being Actively Exploited, Hundreds of Thousands of Sites Defaced
At the end of January, WordPress 4.7.2 was released to fix four security issues, three of which were disclosed at the time of the release. These included a SQL injection vulnerability in WP_Query, a cross-site scripting (XSS) vulnerability in the posts list table, and the Press This feature allowing users without permission to assign taxonomy terms. The fourth and most critical issue, an unauthenticated privilege escalation vulnerability in a REST API endpoint, was fixed silently and disclosed a week after the release.
Apply For the Day of REST Diversity Scholarship Now
The REST API had an amazing year in 2016. Not only was it used by notable websites including the Guggenheim, New York Times, and Wired, content endpoints were merged with core in 4.7.
In March, developers from all over will gather in Boston to discuss and learn about the API in the second annual Day of REST. The conference, created by Human Made, consists of one day of talks with two days of workshops before and after. The REST API was created to make the Internet more open, and channeling that spirit, organizers are offering a diversity scholarship for the conference.
Content Creation Is About More Than an Editor
Content management should be more than TinyMCE and meta boxes. While WordPress has continued to grow into a mature platform, the focus on what should be its core mission has taken a second seat.
We (the WordPress community at large) have gotten so excited about making WordPress awesome, we lost sight of our charge – to enable WordPress to make awesome things. To democratize publishing. To get the stories out of people’s heads and hearts and out to the world.
