WordPress 5.6 and 5.7, and why you need to be more vigilant

WordPress is the most popular Content Management System (CMS) globally, supporting in excess of 30% of all websites in use. The latest version 5.6 & 5.7 add some much welcome functionality, with an eye on the future.

However, as with all technology there is always a price to pay, and some unwelcome unintended consequences. WordPress’s latest version is not an exception, so users need to be even more vigilant and be conscious of security issues some of the new functionalities introduce.

What’s new in WordPress 5.6/5.7?

The most important changes for WordPress 5.6 are preparation for PHP8 and getting ready to dump the old Jquery Libraries for good. However, the little noticed addition of “External Application Access” is the one to look out for when considering security.

Jquery Library

Inevitably these obsolete versions would have been retired soon, and 5.6 is one step closer to the end-of-life, which 5.7 will bring to these old libraries. Your theme and plug-in suppliers should be providing you with updates to prepare for the next version (WordPress 5.7), which will no longer support the old Jquery Libraries.

PHP8

This version is also a Beta version for PHP8, so you can make a foray into using PHP8, but you are still best to stay with PHP7.x until WordPress version for PHP8 is released fully. This will be a while yet as themes and plug-ins need to also catch up.

Auto-update

This is one of the controversial issues. From WordPress 5.6 onwards, the system will automatically update to the next level of Core WordPress, whether you like it or not. Whilst this makes sense from a security perspective, it puts websites at risk if plug-ins are not updated at the same time. Some Themes might also break if they are not ready for the latest version. Either of these could cause problems, or even break your site. Read more here.

External Application Access

The security concerns are around the new function introduced to allow plug-ins and external applications to create users automatically.

This new feature allows external applications to request permission to connect to a site and generate a password for the users of the application or the plug-in. This means the application can perform actions on behalf of a user via the WordPress REST API.

There are number of ways this can be weaponised by bad actors.

Bad actors can create a malicious external application, but disguise it as another application that appears safe, and sends a request for authorisation to users. Once this has been granted, the application has open access to your website, content, users, etc.

Additionally, the application password request URLs send the newly generated password to the requester’s site via a redirect URL. As this has been generated with the permissions of the user that authorised them, an attacker could hijack this link to gain control of a website.

What are the Solutions?

Here are some suggestions to help you keep your website safe, whilst harnessing the power of WordPress.

Automatic Updates

You can manually stop updates, but you need to know what you are doing. You also need to make sure you check your site regularly, and manually update the site. Before you do any update, make sure you make a backup copy, so that you can restore the site in case you have problems.

To stop a Core WordPress update, you need access to your files via FTP or your Hosting Control Panel. Find the file called wp-config.php, open, and add the following line:

define ( ‘WP AUTO UPDATE CORE’ , false);

Save the file and close.

Make sure you use the above command exactly as it is. PHP commands are case sensitive and missing markers can make them useless, or cause serious website failure. Test your site to make sure it is working correctly, as any mistype or error in this command line could be fatal!

Disable Application Passwords

We have always recommended users to install security plug-ins such as WordFence, iThemes Security (formerly Better WP Security), or Sucuri WordPress. Most of these have built defences against this type of attack. See our full article on WordPress Security Settings here.

WordFence, our favourite of these security plug-ins, disables application passwords by default in its latest version. If you have a specific use for application passwords and would like to re-enable application passwords, you can do so under Wordfence >Firewall >Manage Brute Force Protection.

User Setting

If you are deploying an application that uses this functionality, it is best to set the user permission to the minimum requirements (note to application authors!). This means any user created by a malicious application will have minimum access level, hence can do the least amount of damage.

Summary

WordPress is an extremely flexible and powerful tool for creating websites. The pros of using WordPress far out-way any cons. However, WordPress should be deployed with full understanding of “best practices”, and we recommend you use a reputable professional to do it for you.