Issue 259: API flaw exposes 4 million WordPress sites, API error handling bugs, a case for API First
Brief
This week, we focus on the topic of API error handling and how a REST API exposed 4 million WordPress websites to account takeover attacks. We also cover the risks and best practices for designing API error responses, and we look at an article that makes a great case for API-First.
Vulnerability: 4,000,000 WordPress sites vulnerable to improper API error handling
A research team at Wordfence recently discovered a vulnerability in the REST API of a WordPress plugin called the Simple Security plugin. This vulnerability allows a hacker to log into the site as any other registered user without providing a valid security token, effectively bypassing API authentication.
WordPress is a hugely popular web content management system. It’s estimated that this API vulnerability impacted over 4 million WordPress sites.