There is a security advisory out regarding a Snoopy PHP Webclient vulnerability. Since WordPress uses Snoopy internally, we immediately double-checked to be sure that WP isn’t affected. It’s not.
WordPress uses Snoopy internally to fetch RSS feeds for display in the
Dashboard. But by default, all the URLs are hardcoded, and thus not vulnerable to the bug mentioned above. The only way that a WordPress site could be affected is if it had some sort of plugin that allowed users to supply custom feed URLs to the system, and the site had users that the admin could not trust (and who had enough access to provide their own feeds to the plugin).
2 Comments
Well thanks for the headsup Doug
I’m using Snoopy. It’s good stuff.
One Trackback
[...] geek ramblings » Snoopy PHP Webclient Security There is a security advisory out regarding a Snoopy PHP Webclient vulnerability. Since WordPress uses Snoopy internally, we immediately double-checked to be sure that WP isn’t affected. It’s not. [...]