WordPress Releases Two Plugins For Speeding Up Webpages via @sejournal, @martinibuster

The WordPress Core Performance Team released two plugins that speed up webpages with new technologies that pre-render URLs before a user clicks on a link and speeds up lazy-loaded images.

WordPress Core Performance Team

The WordPress Core Performance Team is responsible for coordinating with the different WordPress core development teams for the purpose of improving performance and also to work on projects that directly impact improving core WordPress performance.

The initial plan for the Performance Team consisted of:

• lead the working groups formation
• coordinate the initial administrative tasks (slack channel, weekly meetings, schedule working groups representative nominations, etc.)
• create a mission statement for the team
• coordinate the areas to tackle
• outline the scope and the roadmap

WordPress Performance Plugins

Some of the performance improvements to WordPress are first tested in plugins before they are subsequently integrated into a future version of WordPress.

Users who download the plugins are able to be the first in the world to use and benefit from the webpage speed improvements and it is expected (hoped) that those who are using the plugins will also provide feedback on their experiences, both positive and negative.

The first and most popular plugin released by the Performance Team is the Performance Lab plugin that features five modules that can be turned on or off depending on user needs.

The current modules of the Performance Lab plugin are:

• Dominant Color Images:
  Adds support to store the dominant color of newly uploaded images and create a placeholder background of that color.
• WebP Support Health Check:
  Adds a WebP support check in Site Health status.
• WebP Uploads:
  Creates WebP versions for new JPEG image uploads if supported by the server.
• Enqueued Assets Health Check:
  Adds a CSS and JS resource check in Site Health status.
• Autoloaded Options Health Check:
  Adds a check for autoloaded options in Site Health status

Two New Performance Plugins

The two brand new plugins that were announced today are:

1. Auto-sizes for Lazy-loaded Images
2. Speculation Rules

The two plugins improve performance in two different ways which means that they can both be used to gain the most amount of improvements.

New WordPress Auto-Sizes Plugin

Lazy-loading is a performance optimization technique that defers (pauses) the loading of non-critical images to improve page loading times. Images that are necessary for rendering the visible part of the webpage are loaded first while the ones that are not necessary are deferred until the user scrolls and the images are needed.

What this plugin does is integrates a new lazy loading HTML attribute called sizes=”auto” that sets the “sizes” attribute to “auto” for lazy-loaded images using ‘srcset’ and speeds up the downloading for images that will be needed when the user scrolls down the page.

The sizes=”auto” attribute for images is a part of the responsive images specification in HTML, but it is not specifically related to lazy-loading. Instead, the sizes attribute is used with srcset to provide the browser with the image size dimensions needed to display the image at different viewport sizes. The browser is then able to select the most appropriate image source from the srcset.

New WordPress Speculation Rules Plugin

The Speculation Rules plugin leverages the Speculation Rules API in order to download the resources of webpages that a user is likely to request. The Speculation Rules plugin essentially predicts that a page will be requested and will begin pre-rendering the webpage before a user clicks a link.

The official plugin description explains:

“Uses the Speculation Rules API to prerender linked URLs upon hover by default.”

The Speculation Rules API is a feature designed to improve the performance of web browsing by allowing web pages to provide hints to the browser about potential links that a user might click to navigate to a different webpage. The browser can then prefetch or pre-render resources based on the likelihood of a site visitor clicking a link to navigate to a new webpage.

The Mozilla developer page for the Speculation Rules API explains:

“The Speculation Rules API is designed to improve performance for future navigations. It targets document URLs rather than specific resource files, and so makes sense for multi-page applications (MPAs) rather than single-page applications (SPAs).

The Speculation Rules API provides an alternative to the widely-available feature and is designed to supersede the Chrome-only deprecated feature. It provides many improvements over these technologies, along with a more expressive, configurable syntax for specifying which documents should be prefetched or prerendered.”

The plugin implementation requires the use of at least Chrome 121. Users that visit a site while using a different browser that does not support the Speculation Rules API won’t be affected in any way, the webpage will render as it normally would.

According to the plugin documentation:

“By default, the plugin is configured to prerender WordPress frontend URLs when the user hovers over a relevant link. This can be customized via the “Speculation Rules” section under Settings > Reading.

A filter can be used to exclude certain URL paths from being eligible for prefetching and prerendering (see FAQ section). Alternatively, you can add the ‘no-prerender’ CSS class to any link ( tag) that should not be prerendered.”

Read more about the new WordPress performance plugins and download them here:

WordPress Auto-sizes for Lazy-loaded Images Plugin

WordPress Speculation Rules Plugin

Featured Image by Shutterstock/Haali

WordPress File Manager Plugin Vulnerability Affects +1 Million Websites via @sejournal, @martinibuster

A significant security vulnerability has been identified and patched in the widely used File Manager plugin for WordPress, affecting over 1 million websites. The vulnerability is rated 8.1 out of 10 in severity and could potentially allow unauthenticated attackers to gain access to sensitive information including data contained in site backups.

Unauthenticated Attack Vulnerabilities

What makes this vulnerability a high concern is the fact that a hacker does not need login credentials in order to launch an attack, which is what is meant by the term unauthenticated.

In the context of a WordPress plugin vulnerability, an attacker can gain access to sensitive information without needing to log in or authenticate their identity. This kind of attack exploits a security gap the File Manager plugin referred to as Use of Insufficiently Random Values.

The Common Weakness Enumeration security website describes this kind of vulnerability:

“The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

When product generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.”

This category of vulnerability is due to a weakness in the File Manager plugin’s backup filename generation algorithm. The algorithm combines a timestamp with a four-digit random number but that amount of randomization is not random enough to keep an attacker from successfully guessing the file names and as a consequence enables attackers to gain access to backup files in configurations where there is no .htaccess file to block access.

Use of Insufficiently Random Values Vulnerability

The Use of Insufficiently Random Values vulnerability type is a flaw in the plugin that relies on generating random and unpredictable file numbers in order to prevent attackers from guessing what a backup file name is. The plugins lack of randomization allows an attacker to figure out the file names and gain access to sensitive information.

Vulnerable Versions Of The Plugin

The security vulnerability is found in all versions up to and including 7.2.1 and was patched in the latest update of the plugin, with the release of version 7.2.2.

The update, as noted in the File Manager WordPress Plugin Changelog Documentation, includes a fix for the security issue. Users of the plugin are strongly advised to consider updating to this latest version to protect their websites from potential exploits.

Read the Wordfence advisory for more information:

File Manager <= 7.2.1 – Sensitive Information Exposure via Backup Filenames

Featured Image by Shutterstock/Perfect_kebab

ACF WordPress Plugin Vulnerability Affects Up To 2+ Million Sites via @sejournal, @martinibuster

Advanced Custom Fields (ACF) WordPress plugin with over 2 million installations announced the release of a security update, version 6.2.5 that patches a vulnerability, the severity of which is not known and only limited details were released about the vulnerability.

While it’s not known what kind of exploits are possible or the extent of damage that an attacker could cause, ACF did advise that the vulnerability requires a contributor level access or higher, which to a certain extent makes it more difficult to launch an attack.

ACF 6.2.5 May Introduce Breaking Changes

The security release announcement warned that the changes introduced by the update patch had the potential to cause websites to break and offered instructions on how to debug the changes.

The version 6.2.5 update introduces a significant change in how the ACF shortcode processes and outputs potentially unsafe HTML content. The output will now be escaped, a security process that typically removes unwanted HTML like malicious scripts or malformed HTML so that rendered HTML is secure.

However, this change, while enhancing security, might disrupt sites using the shortcode for rendering complex HTML elements like scripts or iframes.

Tags with a potential for misuse, such as

Complianz WordPress GDPR Compliance Plugin Vulnerability via @sejournal, @martinibuster

A popular WordPress plugin for privacy compliance with over 800,000 installations recently patched a stored XSS vulnerability that could allow an attacker to upload malicious scripts for launching attacks against site visitors.

Complianz | GDPR/CCPA Cookie Consent WordPress Plugin

The Complianz plugin for WordPress is a powerful tool that helps website owners comply with privacy regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

The plugin manages multiple facets of user privacy including blocking third-party cookies, managing cookie consent (including per subregion), and managing multiple aspects related to cookie banners.

It’s versatility and usefulness may account for the popularity of the tool which currently has over 800,000 installations.

Complianz Plugin Stored XSS Vulnerability

The Complianz WordPress plugin was discovered to have a stored XSS vulnerability which is a type of vulnerability that allows a user to upload a malicious script directly to the website server. Unlike a reflected XSS that requires a website user to click a link, a stored XSS involves a malicious script stored and served from the target website’s server.

The vulnerability is in the Complianz admin settings which is in the form of a lack of two security functions.

1. Input Sanitization
The plugin lacked sufficient input sanitization and output escaping. Input sanitization is a standard process for checking what’s input into a website, like into a form field, to make sure that what’s input is what’s expected, like a text input as opposed to a script upload.

The official WordPress developer guide describes data sanitization as:

“Sanitizing input is the process of securing/cleaning/filtering input data. Validation is preferred over sanitization because validation is more specific. But when “more specific” isn’t possible, sanitization is the next best thing.”

2. Escaping Output
The plugin lacked Output Escaping which is a security process that removes unwanted data before it gets rendered for a user.

How Serious Is The Vulnerability?

The vulnerability requires the attacker to obtain admin permission levels and higher in order to execute the attack. That may be the reason why this vulnerability is scored 4.4 out of 10, with ten representing the highest level of vulnerability.

The vulnerability only affects specific kinds of installations, too.

According to Wordfence:

“This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

This only affects multi-site installations and installations where unfiltered_html has been disabled.”

Update To Latest Version

The vulnerability affects Complianz versions equal to or less than version 6.5.5. Users are encouraged to update to version 6.5.6 or higher.

Read the Wordfence advisory about the vulnerability:

Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 – Authenticated(Administrator+) Stored Cross-site Scripting via settings

WordPress Google Fonts Plugin Vulnerability Affects Up To +300,000 Users via @sejournal, @martinibuster

A vulnerability rated as High was recently patched in a Google Fonts optimization plugin for WordPress, allowing attackers to delete entire directories and upload malicious scripts.

OMGF | GDPR/DSGVO Compliant WordPress Plugin

The plugin, OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy., optimizes the use of Google Fonts to reduce page speed impact and is also GDPR compliant, making it valuable for users in the European Union looking to implement Google Fonts.

Screenshot of Wordfence Vulnerability Rating

Vulnerability

The vulnerability is particularly concerning because it allows unauthenticated attackers. “Unauthenticated” means that an attacker doesn’t need to be registered on the website or have any level of credentials.

The vulnerability is described as enabling unauthenticated directory deletion and allowing the upload of Cross-Site Scripting (XSS) payloads.

Cross-Site Scripting (XSS) is a type of attack where a malicious script is uploaded to a website server, which can then be used to remotely attack the browsers of any visitors. This can result in accessing a user’s cookies or session information, enabling the attacker to assume the privilege level of that user visiting the site.

The cause of the vulnerability, as identified by Wordfence researchers, is a lack of a capability check – a security feature that checks whether a user has access to a specific feature of a plugin, in this case, an admin-level feature.

An official WordPress developer page for plugin makers says this about capability checking:

“User capabilities are the specific permissions that you assign to each user or to a User role.

For example, Administrators have the “manage_options” capability which allows them to view, edit and save options for the website. Editors on the other hand lack this capability which will prevent them from interacting with options.

These capabilities are then checked at various points within the Admin. Depending on the capabilities assigned to a role; menus, functionality, and other aspects of the WordPress experience may be added or removed.

As you build a plugin, make sure to run your code only when the current user has the necessary capabilities.”

Wordfence describes the cause of the vulnerability:

“…is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9.”

Wordfence also states that previous updates attempted to close the security gap but considers version 5.7.10 to be the most secure version of the plugin.

Read the Wordfence vulnerability warning:

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 – Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting

WordPress Starter Templates AI – Build A Site In 60 Seconds via @sejournal, @martinibuster

Astra Starter Templates by Brainstorm Force, with over one million active installations, announced the integration of the ZipWP AI website builder that enables users to create entire websites, including content and images.

With over 280 customizable website templates that helps users quickly create professional-looking websites, it’s one of the most popular templates in the world with over one million active installations.

Creating websites with templates and page builders like Elementor and Beaver Builder, still required a modest learning curve.

The integration of ZipWP into the WPAstra Starter Templates solves that problem in a way that brings the simplicity of closed-source web design to the open source WordPress ecosystem.

ZipWP is a website builder that uses artificial intelligence to help users rapidly create functional WordPress websites with no coding or technical knowledge required.

The standalone version of ZipWP handles everything from installation and design to even creating the content for a fully configured website, including the images.

ZipWP claims that the AI can create an entire website in sixty seconds.

Screenshot of ZipWP Website

Both the standalone version and the version that’s integrated into the WPAstra Starter Templates offers features like automated website design, website content, and drag-and-drop webpage customization in a simple way that makes creating a website accessible to users of all technical levels.

The purpose isn’t necessarily to replace to web designers as it’s also useful for agencies that wish to scale their web design services while retaining total control and benefiting from the open source WordPress environment.

That means that the entire WordPress ecosystem of plugins are available for customizing websites created with the ZipWP functionality.

Users hoping to take advantage of the ZipWP functionality will have to register for an account with ZipWP.

ZipWP offers both free and premium tiers.

The free version allows users to create up to three websites per month. The premium version allows the creation of ten websites per day and other benefits for the price of $399/year.

According to the WPAstra changelog announcement:

“It will require connecting the user to their ZipWP account and providing their business details, after which it will generate content + images for patterns and pages based on the specified business details.”

Read the WPAstra changelog:

Starter Templates 3.5.2 : All new AI based Template Kit library

Learn more about ZipWP AI Website Builder

WordPress Releases Version 6.4.2 For Critical Vulnerability via @sejournal, @martinibuster

WordPress has released version 6.4.2 that contains a patch for a critical severity vulnerability that could allow attackers to execute PHP code on the site and potentially lead to a full site takeover.

The vulnerability was traced back to a feature introduced in WordPress 6.4 that was meant to improve HTML parsing in the block editor.

The issue is not present in earlier versions of WordPress and it only affects versions 6.4 and 6.4.1.

An official WordPress announcement describes the vulnerability:

“A Remote Code Execution vulnerability that is not directly exploitable in core, however the security team feels that there is a potential for high severity when combined with some plugins, especially in multisite installs.”

According to an advisory published by Wordfence:

“Since an attacker able to exploit an Object Injection vulnerability would have full control over the on_destroy and bookmark_name properties, they can use this to execute arbitrary code on the site to easily gain full control.

While WordPress Core currently does not have any known object injection vulnerabilities, they are rampant in other plugins and themes. The presence of an easy-to-exploit POP chain in WordPress core substantially increases the danger level of any Object Injection vulnerability.”

Object Injection Vulnerability

Wordfence advises that Object Injection vulnerabilities are not easy to exploit. Nonetheless they are recommending that users of WordPress update the latest versions.

WordPress itself advises that users update their sites immediately.

Read the official WordPress announcement:

WordPress 6.4.2 Maintenance & Security Release

Read the Wordfence advisory:

PSA: Critical POP Chain Allowing Remote Code Execution Patched in WordPress 6.4.2

Featured Image by Shutterstock/Nikulina Tatiana