Oxygen released version 4.8.3 which is a security update. The security issue addressed is a privilege escalation vulnerability that would allow a user with “contributor” or higher permissions to escalate their privileges to an admin (CVE-2024-4662). This issue impacts anyone that has granted untrusted users Contributor+ access to their WordPress website. It does not affect you if you do not have Contributor+ users on your WordPress website.

Joost on the fear marketing of WordPress security.

The latest version of Pods is a security release. Hotfixes for various Pods versions are available.

Roger Montti of the Search Engine Journal asked WPScan and Wordfence what site owners need to know about medium level vulnerabilities?

With the help of breakdance XSS any user can trick the admin user to execute PHP code without them knowing it. The code is written by the Editor (or any other user role) and later executed unknowingly by the administrator.

A year ago we were all urged to jump on the passkeys train because it was superior security. In this article the author describes two problems – vendor lock-in and uneven implementation.

A security researcher alerted MainWP that some customer account information had been found in a large dump of compromised accounts. The notification says the accounts may be ones where users reused their credentials on multiple sites. MainWP reset all passwords and are requiring two factor authentication going forward. The account information is logging into the MainWP website, not ones related to connected sites.

An interesting list of steps and code for better securing a WordPress site from a WordPress veteran.

The topic of WordPress security is timely. WordPress 6.5.2 is a security and fix release just dropped.