Connect with us

NEWS

WooCommerce Vulnerability Affects Millions of WordPress Sites via @sejournal, @martinibuster

Published

on

WooCommerce announced they have patched a critical vulnerability affecting millions of users. Publishers using the WooCommerce plugin or the WooCommerce Blocks plugin are strongly urged to update their plugins if they have not already automatically updated.

WooCommerce Forced Automatic Update

The vulnerability known as a SQL Injection Vulnerability is so severe that WooCommerce is pushing the update automatically to affected publishers.

Although the updates are automatic, some publishers are reporting that some of their sites did not receive the update yet.

So it’s important to check and manually update if the site has not yet updated to the highest version of your WooCommerce version branch.

Advertisement

Continue Reading Below

In general, a SQL Injection is a vulnerability that allows an malicious hacker to affect the database in a way that makes it display information or behave differently in ways it’s not supposed to, like in general, as an example, of being able to manipulate the database into revealing a password.

According to WooCommerce:

“If a store was affected, the exposed information will be specific to what that site is storing but could include order, customer, and administrative information.”

The announcement by WordFence noted that this is a Blind SQL Injection vulnerability.

Advertisement

WordFence explained the impact:

“This vulnerability allowed unauthenticated attackers to access arbitrary data in an online store’s database.

The Wordfence Threat Intelligence team was able to develop proofs of concept for time-based and boolean-based blind injections and released an initial firewall rule to our Premium customers within hours of the patch.”

Advertisement

Continue Reading Below

Have WooCommerce Sites Been Compromised?

There is currently no evidence of a widespread attacks compromising WooCommerce sites.

WordFence stated:

“Wordfence Threat Intelligence has found extremely limited evidence of these attempts and it is likely that such attempts were highly targeted.”

WooCommerce Software Version Branches

What is meant by the version branch is the number associated with the version a publisher is using.

A publisher can be using a very old version 3.x, a version 4.x and the latest version 5.x. Each of those versions, 3, 4 and 5 are considered a branch.

Advertisement

WooCommerce versions 4.x and 5.x are called branches of the software and version 5 is considered a major step up from version 4.

Some publishers may find it disruptive to update from version 4.x to 5.x.

To accommodate those publishers, WooCommerce released a patch that closes the vulnerability for each branch.

So if a site has WooCommerce version 4.x, they are encouraged to update to at least version 4.8.1, which is the very latest version of the 4.x WooCommerce branch.

Nevertheless, although the latest version of older branches are patched, the official announcement recommends updating to the very latest version of WooCommerce, currently version 5.5.1.

The announcement noted:

“…we still highly recommend you ensure that you’re using the latest versions of WooCommerce and WooCommerce Blocks (5.5.1).”

Advertisement

Continue Reading Below

Advertisement

That statement may have inadvertently caused a little confusion as to how far up the version branch publishers should update.

Some publishers were wondering that if they’re using version 4.x, if it’s safe or should they update to the latest version of the highest branch in WooCommerce, currently version 5.5.1?

That’s what someone asked in the comments section of the official announcement:

“Is the Woocommerce Version 4.8.1. safe now or not?”

Someone from WooCommerce answered with the following statement:

“As this critical vulnerability concerns the WooCommerce plugin, we highly recommend ensuring this is up to date first.

The version you mention, 4.8.1, contains the security patch so there’s nothing else you need to do here until you’re ready to update to the latest version (5.5.1).”

Advertisement

Continue Reading Below

Citations

Official WooCommerce Announcement
Critical Vulnerability Detected in WooCommerce on July 13, 2021 – What You Need to Know

Advertisement

WordFence Report and Analysis of the Vulnerability
Critical SQL Injection Vulnerability Patched in WooCommerce

Searchenginejournal.com

NEWS

Google December Product Reviews Update Affects More Than English Language Sites? via @sejournal, @martinibuster

Published

on

Google’s Product Reviews update was announced to be rolling out to the English language. No mention was made as to if or when it would roll out to other languages. Mueller answered a question as to whether it is rolling out to other languages.

Google December 2021 Product Reviews Update

On December 1, 2021, Google announced on Twitter that a Product Review update would be rolling out that would focus on English language web pages.

The focus of the update was for improving the quality of reviews shown in Google search, specifically targeting review sites.

A Googler tweeted a description of the kinds of sites that would be targeted for demotion in the search rankings:

“Mainly relevant to sites that post articles reviewing products.

Think of sites like “best TVs under $200″.com.

Goal is to improve the quality and usefulness of reviews we show users.”

Advertisement

Advertisement

Continue Reading Below

Google also published a blog post with more guidance on the product review update that introduced two new best practices that Google’s algorithm would be looking for.

The first best practice was a requirement of evidence that a product was actually handled and reviewed.

The second best practice was to provide links to more than one place that a user could purchase the product.

The Twitter announcement stated that it was rolling out to English language websites. The blog post did not mention what languages it was rolling out to nor did the blog post specify that the product review update was limited to the English language.

Google’s Mueller Thinking About Product Reviews Update

Screenshot of Google's John Mueller trying to recall if December Product Review Update affects more than the English language

Screenshot of Google's John Mueller trying to recall if December Product Review Update affects more than the English language

Product Review Update Targets More Languages?

The person asking the question was rightly under the impression that the product review update only affected English language search results.

Advertisement

Advertisement

Continue Reading Below

But he asserted that he was seeing search volatility in the German language that appears to be related to Google’s December 2021 Product Review Update.

This is his question:

“I was seeing some movements in German search as well.

So I was wondering if there could also be an effect on websites in other languages by this product reviews update… because we had lots of movement and volatility in the last weeks.

…My question is, is it possible that the product reviews update affects other sites as well?”

John Mueller answered:

“I don’t know… like other languages?

My assumption was this was global and and across all languages.

But I don’t know what we announced in the blog post specifically.

Advertisement

But usually we try to push the engineering team to make a decision on that so that we can document it properly in the blog post.

I don’t know if that happened with the product reviews update. I don’t recall the complete blog post.

But it’s… from my point of view it seems like something that we could be doing in multiple languages and wouldn’t be tied to English.

And even if it were English initially, it feels like something that is relevant across the board, and we should try to find ways to roll that out to other languages over time as well.

So I’m not particularly surprised that you see changes in Germany.

But I also don’t know what we actually announced with regards to the locations and languages that are involved.”

Does Product Reviews Update Affect More Languages?

While the tweeted announcement specified that the product reviews update was limited to the English language the official blog post did not mention any such limitations.

Google’s John Mueller offered his opinion that the product reviews update is something that Google could do in multiple languages.

Advertisement

One must wonder if the tweet was meant to communicate that the update was rolling out first in English and subsequently to other languages.

It’s unclear if the product reviews update was rolled out globally to more languages. Hopefully Google will clarify this soon.

Citations

Google Blog Post About Product Reviews Update

Product reviews update and your site

Google’s New Product Reviews Guidelines

Write high quality product reviews

John Mueller Discusses If Product Reviews Update Is Global

Watch Mueller answer the question at the 14:00 Minute Mark

[embedded content]

Searchenginejournal.com

Continue Reading




DON'T MISS ANY IMPORTANT NEWS!
Subscribe To our Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

Trending

en_USEnglish