Submitted 1 day ago by 
sanitation@lemmy.today to selfhosted@lemmy.world
https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core
7.0.2 got released on Friday. Exploits are already happening.
4 of my customers websites got hacked. I was busy the last days and weren’t up to date.
Good time to notice that 2 backups failed without me noticing it. Fml
CausticFlames@sopuli.xyz 1 day ago Friendly reminder to anyone who cares enough that you can still use WordPress to make your site with all your fancy plugins and layouts, and then export that to a static site for hosting. No need to actually host Wordpress itself that way you avoid nearly all of this BS.
LunarLoony@lemmy.sdf.org 22 hours ago Not a bad idea. How would one do this?
CausticFlames@sopuli.xyz 19 hours ago Simply Static is currently the most actively maintained solution, as a plugin for wp:
docs.simplystatic.com/category/6-user-guides
There is also WP2Static, which is a very long standing project: github.com/elementor/wp2static
yuman@programming.dev 10 hours ago this thing here. I’ve dramatically reduced support work at two shops I’ve set this up for. incidents went from from coupla times a month to once a year. not to mention - you don’t need no VPS no more, don’t need no database, nothing, the simplest web hosting will do and it’s very cache friendly.
It’s time to ditch WP if you haven’t already
It was time in 2013.
What would you recommend as an alternative for the non-technical inclined users who want to have a public website?
xzinik@feddit.cl 21 hours ago thank god i was able to convince my boss to let go the old wordpress site and only serve static pages when he wanted to have a brand new design, its been about 2months with the new design
ThanksObama@sh.itjust.works 1 day ago
Correction: WordPress IS a critical vulnerability.
ctenidium@lemmy.world 3 hours ago
Elementor makes it worse though.
9point6@lemmy.world 1 day ago
www.wordfence.com/threat-intel/vulnerabilities
The CVE list always cracks me up, there’s like tens daily
chronicledmonocle@lemmy.world 19 hours ago
JFC I thought you were exaggerating.
SreudianFlip@sh.itjust.works 1 day ago
Anyone who hosts websites can check the logs and see the bots hammering away at wp/admin primarily, even if you are not running any WordPress. Low hanging meat? Fresh fruit?
Marthirial@lemmy.world 1 day ago
I have developed and hosted over 760 WP sites since 2006 and have never been hacked. Ever.
Mediocre craftspeople blame their tools.
kungen@feddit.nu 1 day ago
I’ve driven a poorly designed car without many safety features for years, and I’ve never flown through the windshield, ever.
How do you know?
genzboomer@lemmy.zip 1 day ago
Professionals are never cocky. Cocky comes back to bite.
loo@lemmy.world 1 day ago
Glad you got lucky. But a tool having one critical vulnerability after another has nothing to do with mediocre craftsmanship and blaming admins for getting hacked after updating their software is nothing but disrespectful and condescending