Weekend Short: The WordPress Plugin Fix That Needs a Backup First
It's Saturday, so this is a short one. One threat, one tip.
The threat: a flaw in a widely used WordPress plugin is being actively exploited. The fix is out, which is good news. The wrinkle is that the process of installing that fix can briefly expose some sites one last time while the update swaps over. Automated scans don't care that you're mid-update.
Who's affected? If you run your own WordPress site, or you look after one for a club, a church, a small shop or a village hall, this one's for you. If someone else hosts and manages your site, they should be doing this — but it's still worth checking with them.
Who isn't? Most households listening. You don't need to do anything about this on your phone or laptop.
The tip is simple. Take a backup before you touch anything. Then install the pending plugin update promptly. If your host lets you schedule updates, do it out of hours when fewer people are browsing. Afterwards, load the site once and check it looks right.
If you're not sure which plugins you've got, log into the dashboard, open the Plugins page and look for anything showing an update available. Don't delete plugins you don't recognise — that's a job for whoever built the site.
On the wider picture, our dark web monitoring is still running: just over 3,300 alerts recorded and eleven active targets being watched. Nothing new there for a normal household to act on beyond the usual habits — unique passwords for every account and two-step verification switched on wherever it's offered.
We're not covering the OpenSSH SSHole story today because we've already covered the recent OpenSSH fixes on the show, and this weekend we wanted to focus on the one that touches ordinary site owners.
So: back up, update, check the site. That's the weekend job.
Related reading