How Yoast Can Become an Attack Vector for Hackers, and How to Stop It – Joe Youngblood joeyoungblood.com

Ashley Rich 4 years ago in Security 2

TL;DR WordPress creates Author Archives pages for anyone who publishes content on a website sometimes keeping that page live even if that content is transferred to another user. By default […]

voters

Ashley Rich

Report Article

.replybox-fallback, .replybox-fallback ul { list-style: none; }

tnash says:

July 6, 2020 at 10:08 am

Articles like this make my blood boil usernames are not secret if obscuring usernames is part of your threat modelling you are doing it wrong. There are literally a dozen ways of getting the usernames from the site, honestly using XML Sitemaps is pretty low on the list, I actually think Ben response from Yoast is spot on and much kinder then I would have been to the author.

Pieter says:

July 8, 2020 at 8:19 am

Well, part of the Yoast comment sums it up nicely: “Lastly, we recommend not writing articles/posts with your admin account but creating a second user with only editor rights as the author to write your blog posts (see article: https://yoast.com/wordpress-security/#editoraccount).”

Usernames are not secure or secret. So don’t rely on them for security.

Reply

WP Content

How Yoast Can Become an Attack Vector for Hackers, and How to Stop It – Joe Youngblood joeyoungblood.com

Recent

Recent Comments

Related Articles

Recent

Recent Comments

Login

Register