A serious flaw in a WordPress add-on is being used in real attacks. Who updates yours? Three questions to ask your web person.
What happened
- This month a serious flaw in a WordPress add-on (a plugin) called Bricksforge was used in real attacks, from 7 October.
- If your site is on Wix, Squarespace or Shopify, this one is not about you. The maker fixed it.
- Sites that updated in time were protected from this flaw. Sites that did not stayed open to it.
- If yours has not updated, it is not too late: update today. To see if you use it, log in, click Plugins on the left and look for “Bricksforge”.
That is the whole lesson: the fix existed, and someone had to apply it.
No one looks after your site? Then that is the first thing to fix, and we can help.
Three questions to ask whoever looks after your site
- “Who updates our WordPress add-ons, and how often?” If the answer is “when someone remembers”, that is the risk.
- “Which add-ons do we use?” Ask for the list. An add-on nobody uses should be removed: it is one more way in.
- “Will you tell me in writing when a serious flaw hits one of ours, and when it is fixed?”
After a flaw, check, don’t just update
- Updating stops new attacks. It does not remove a file that was already planted.
- Ask for the site to be checked for unknown files that should not be there.
What we do
- We are Sahbis.
- Our Care service looks after your website for you: hosting (where your site lives), security, a monthly check and basic fixes, included for 12 months.
- Ask us what it costs after that. Email hello@sahbis.com with your web address and we will tell you what we would do first.
- Not sure where your site stands? The free Sitecomb check gives a score out of 100 and the areas that need work, in about a minute.
- It does not change your site.
Want it checked for you?
Sitecomb, our website checker, scores any website across six areas for free.
Its full report gives a plain fix for each problem. Or tell us what needs fixing.