{"id":9647,"date":"2017-09-20T06:21:59","date_gmt":"2017-09-20T04:21:59","guid":{"rendered":"http:\/\/www.wpbeveiligen.nl\/?p=9647"},"modified":"2017-09-20T06:21:59","modified_gmt":"2017-09-20T04:21:59","slug":"9-beveiligingsproblemen-verholpen-wordpress-4-8-2","status":"publish","type":"post","link":"https:\/\/wpbeveiligen.nl\/nieuws\/9-beveiligingsproblemen-verholpen-wordpress-4-8-2\/","title":{"rendered":"9 beveiligingsproblemen verholpen in WordPress 4.8.2"},"content":{"rendered":"

WordPress 4.8.2 lost 9 beveiligingslekken op.<\/strong><\/p>\n

Enkele nieuwe features in WordPress hebben ook weer wat mogelijkheden voor hackers gebracht. Daar kwamen verschillende “white hat hackers” achter die het netjes aan WordPress gemeld hebben.<\/p>\n

WordPress heeft die problemen direct opgelost in deze nieuwe 4.8.2 update. Het team achter WordPress heeft ook potenti\u00eble toekomstige problemen die door plugins konden ontstaan aangepakt.<\/p>\n

Veiligheid voor alles!<\/h2>\n

Updaten dus \ud83d\ude09<\/strong><\/p>\n

Onderstaand zie je de 9 lekken die opgelost zijn. Het gaat hier om potenti\u00eble mogelijkheden<\/strong> voor hackers om injecties te doen op de database, om de paden van de server te benaderen en er zitten updates bij om WordPress te beschermen tegen\u00a0plugins met onveilige codering<\/a>.<\/p>\n

5 van de 9 problemen zijn XSS lekken. Weet je niet wat een XSS is? Lees dan meer over XSS<\/a>.<\/p>\n

    \n
  1. $wpdb->prepare()<\/code>\u00a0can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we\u2019ve added hardening to prevent plugins<\/a> and themes from accidentally causing a vulnerability. Reported by\u00a0Slavco.<\/li>\n
  2. A cross-site scripting (XSS<\/a>) vulnerability was discovered in the oEmbed discovery. Reported by xknown of the WordPress Security Team.<\/li>\n
  3. A cross-site scripting (XSS<\/a>) vulnerability was discovered in the visual editor. Reported by\u00a0Rodolfo Assis (@brutelogic)\u00a0of Sucuri Security.<\/li>\n
  4. A path traversal vulnerability was discovered in the file unzipping code. Reported by\u00a0Alex Chapman (noxrnet).<\/li>\n
  5. A cross-site scripting (XSS<\/a>) vulnerability was discovered in the plugin editor. Reported by (Chen Ruiqi).<\/li>\n
  6. An open redirect was discovered on the user and term edit screens. Reported by\u00a0Yasin Soliman (ysx).<\/li>\n
  7. A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team.<\/li>\n
  8. A cross-site scripting (XSS<\/a>) vulnerability was discovered in template names. Reported by\u00a0Luka (sikic).<\/li>\n
  9. A cross-site scripting (XSS<\/a>) vulnerability was discovered in the link modal. Reported by\u00a0Anas Roubi (qasuar).<\/li>\n<\/ol>\n

    En voor de klanten met een beveiligings abonnement<\/a> bij ons, wij maken zoals altijd een backup en updaten je website naar de nieuwste en weer veilige WordPress 4.8.2<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    WordPress 4.8.2 lost 9 beveiligingslekken op. Enkele nieuwe features in WordPress hebben ook weer wat mogelijkheden voor hackers gebracht. Daar kwamen verschillende “white hat hackers” achter die het netjes aan WordPress gemeld…<\/p>\n","protected":false},"author":1,"featured_media":25883,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,17,51],"tags":[3,7],"class_list":["post-9647","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-beveiligen","category-hackers","category-updaten","tag-beveiliging","tag-hackers"],"_links":{"self":[{"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/posts\/9647","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/comments?post=9647"}],"version-history":[{"count":0,"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/posts\/9647\/revisions"}],"wp:attachment":[{"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/media?parent=9647"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/categories?post=9647"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/nieuws\/wp-json\/wp\/v2\/tags?post=9647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}