Connect with us

SEO

Vulnerability In Fluent Forms Contact Form WordPress Plugin

Published

on

Vulnerability In Fluent Forms Contact Form WordPress Plugin

The popular Fluent Forms Contact Form Builder plugin for WordPress, with over 300,000 installations, was discovered to contain a SQL Injection vulnerability that could allow database access to hackers.

Fluent Forms Contact Form Builder

Fluent Forms Contact Form Builder is one of the most popular contact forms for WordPress, with over 300,000 installations.

Its drag-and-drop interface makes creating custom contact forms easy so that users don’t have to learn how to code.

The ability to use the plugin to create virtually any kind of input form makes it a top choice.

Users can leverage the plugin to create subscription forms, payment forms, and forms for creating quizzes.

Plus it integrates with third party applications like MailChimp, Zapier and Slack.

Importantly, it also has a native analytics capability.

This incredible flexibility makes Fluent Forms a top choice because users can accomplish so much with just one plugin.

Input Neutralization

Every plugin that allows site visitors to input data directly into the database, especially contact forms, must process those inputs so that they do not inadvertently allow hackers to input scripts or SQL commands that allows malicious users to make unexpected changes.

This particular vulnerability makes the Fluent Forms plugin open to a SQL injection vulnerability which is particularly bad if a hacker is successful in their attempts.

SQL Injection Vulnerability

SQL, which means Structured Query Language, is a language used for interacting with databases.

A SQL query is a command for accessing, changing or organizing data that’s stored in a database.

A database is what contains everything that is used to create a WordPress website, such as passwords, content, themes and plugins.

The database is the heart and brain of a WordPress website.

As a consequence, the ability to arbitrarily “query” a database is an extraordinary level of access that should absolutely not be available to unauthorized users or software outside of the website.

A SQL injection attack is when a malicious attacker is able to use an otherwise legitimate input interface to insert a SQL command that can interact with the database.

The non-profit Open Worldwide Application Security Project (OWASP) describes the devastating consequences of a SQL injection vulnerability:

  • “SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.
  • SQL Injection is very common with PHP and ASP applications due to the prevalence of older functional interfaces. Due to the nature of programmatic interfaces available, J2EE and ASP.NET applications are less likely to have easily exploited SQL injections.
  • The severity of SQL Injection attacks is limited by the attacker’s skill and imagination, and to a lesser extent, defense in depth countermeasures, such as low privilege connections to the database server and so on. In general, consider SQL Injection a high impact severity.”

Improper Neutralization

The United States Vulnerability Database (NVD) published an advisory about the vulnerability that described the reason for the vulnerability as from “improper neutralization.”

Neutralization is a reference to a process of making sure that anything that’s input into an application (like a contact form) will be limited to what is expected and will not allow anything other than what is expected.

Proper neutralization of a contact form means that it won’t allow a SQL command.

The United States Vulnerability Database described the vulnerability:

“Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Contact Form – WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.

This issue affects Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.”

Patchstack security company discovered and reported the vulnerability to the plugin developers.

According to Patchstack:

“This could allow a malicious actor to directly interact with your database, including but not limited to stealing information.

This vulnerability has been fixed in version 5.0.0.”

Although Patchstack’s advisory states that the vulnerability was fixed in Version 5.0.0, there is no indication of a security fix according to the Fluent Form Contact Form Builder changelog, where changes to the software are routinely logged.

This is the Fluent Forms Contact Form Builder changelog entry for version 5.0.0:

  • “5.0.0 (DATE: JUNE 22, 2023)
    Revamped UI and better UX
  • Global Styler Improvement
  • The new framework for faster response
  • Fixed issue with repeater field not appearing correctly on PDF
  • Fixed issue with WPForm Migrator not properly transferring text fields to text input fields withcorrect maximum text length
  • Fixed issue with entry migration
  • Fixed number format in PDF files
  • Fixed radio field label issue
  • Updated Ajax routes to Rest Routes
  • Updated filter & action hooks naming convention with older hooks support
  • Updated translation strings”

Vulnerability In Fluent Forms Contact Form WordPress Plugin

It’s possible that one of those entries is the fix. But some plugin developers want to keep security fixes secret, for whatever reason.

Recommendations:

It’s recommended that users of the contact form update their plugin as soon as possible.

Featured image by Shutterstock/Kues

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address

SEO

GPT Store Set To Launch In 2024 After ‘Unexpected’ Delays

Published

on

By

GPT Store Set To Launch In 2024 After 'Unexpected' Delays

OpenAI shares its plans for the GPT Store, enhancements to GPT Builder tools, privacy improvements, and updates coming to ChatGPT.

  • OpenAI has scheduled the launch of the GPT Store for early next year, aligning with its ongoing commitment to developing advanced AI technologies.
  • The GPT Builder tools have received substantial updates, including a more intuitive configuration interface and improved file handling capabilities.
  • Anticipation builds for upcoming updates to ChatGPT, highlighting OpenAI’s responsiveness to community feedback and dedication to AI innovation.

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

96.55% of Content Gets No Traffic From Google. Here’s How to Be in the Other 3.45% [New Research for 2023]

Published

on

96.55% of Content Gets No Traffic From Google. Here's How to Be in the Other 3.45% [New Research for 2023]

It’s no secret that the web is growing by millions, if not billions of pages per day.

Our Content Explorer tool discovers 10 million new pages every 24 hours while being very picky about the pages that qualify for inclusion. The “main” Ahrefs web crawler crawls that number of pages every two minutes. 

But how much of this content gets organic traffic from Google?

To find out, we took the entire database from our Content Explorer tool (around 14 billion pages) and studied how many pages get traffic from organic search and why.

How many web pages get organic search traffic?

96.55% of all pages in our index get zero traffic from Google, and 1.94% get between one and ten monthly visits.

Distribution of pages by traffic from Content Explorer

Before we move on to discussing why the vast majority of pages never get any search traffic from Google (and how to avoid being one of them), it’s important to address two discrepancies with the studied data:

  1. ~14 billion pages may seem like a huge number, but it’s not the most accurate representation of the entire web. Even compared to the size of Site Explorer’s index of 340.8 billion pages, our sample size for this study is quite small and somewhat biased towards the “quality side of the web.”
  2. Our search traffic numbers are estimates. Even though our database of ~651 million keywords in Site Explorer (where our estimates come from) is arguably the largest database of its kind, it doesn’t contain every possible thing people search for in Google. There’s a chance that some of these pages get search traffic from super long-tail keywords that are not popular enough to make it into our database.

That said, these two “inaccuracies” don’t change much in the grand scheme of things: the vast majority of published pages never rank in Google and never get any search traffic. 

But why is this, and how can you be a part of the minority that gets organic search traffic from Google?

Well, there are hundreds of SEO issues that may prevent your pages from ranking well in Google. But if we focus only on the most common scenarios, assuming the page is indexed, there are only three of them.

Reason 1: The topic has no search demand

If nobody is searching for your topic, you won’t get any search traffic—even if you rank #1.

For example, I recently Googled “pull sitemap into google sheets” and clicked the top-ranking page (which solved my problem in seconds, by the way). But if you plug that URL into Ahrefs’ Site Explorer, you’ll see that it gets zero estimated organic search traffic:

The top-ranking page for this topic gets no traffic because there's no search demandThe top-ranking page for this topic gets no traffic because there's no search demand

This is because hardly anyone else is searching for this, as data from Keywords Explorer confirms:

Keyword data from Ahrefs' Keywords Explorer confirms that this topic has no search demandKeyword data from Ahrefs' Keywords Explorer confirms that this topic has no search demand

This is why it’s so important to do keyword research. You can’t just assume that people are searching for whatever you want to talk about. You need to check the data.

Our Traffic Potential (TP) metric in Keywords Explorer can help with this. It estimates how much organic search traffic the current top-ranking page for a keyword gets from all the queries it ranks for. This is a good indicator of the total search demand for a topic.

You’ll see this metric for every keyword in Keywords Explorer, and you can even filter for keywords that meet your minimum criteria (e.g., 500+ monthly traffic potential): 

Filtering for keywords with Traffic Potential (TP) in Ahrefs' Keywords ExplorerFiltering for keywords with Traffic Potential (TP) in Ahrefs' Keywords Explorer

Reason 2: The page has no backlinks

Backlinks are one of Google’s top three ranking factors, so it probably comes as no surprise that there’s a clear correlation between the number of websites linking to a page and its traffic.

Pages with more referring domains get more trafficPages with more referring domains get more traffic
Pages with more referring domains get more traffic

Same goes for the correlation between a page’s traffic and keyword rankings:

Pages with more referring domains rank for more keywordsPages with more referring domains rank for more keywords
Pages with more referring domains rank for more keywords

Does any of this data prove that backlinks help you rank higher in Google?

No, because correlation does not imply causation. However, most SEO professionals will tell you that it’s almost impossible to rank on the first page for competitive keywords without backlinks—an observation that aligns with the data above.

The key word there is “competitive.” Plenty of pages get organic traffic while having no backlinks…

Pages with more referring domains get more trafficPages with more referring domains get more traffic
How much traffic pages with no backlinks get

… but from what I can tell, almost all of them are about low-competition topics.

For example, this lyrics page for a Neil Young song gets an estimated 162 monthly visits with no backlinks: 

Example of a page with traffic but no backlinks, via Ahrefs' Content ExplorerExample of a page with traffic but no backlinks, via Ahrefs' Content Explorer

But if we check the keywords it ranks for, they almost all have Keyword Difficulty (KD) scores in the single figures:

Some of the low-difficulty keywords a page without traffic ranks forSome of the low-difficulty keywords a page without traffic ranks for

It’s the same story for this page selling upholstered headboards:

Some of the low-difficulty keywords a page without traffic ranks forSome of the low-difficulty keywords a page without traffic ranks for

You might have noticed two other things about these pages:

  • Neither of them get that much traffic. This is pretty typical. Our index contains ~20 million pages with no referring domains, yet only 2,997 of them get more than 1K search visits per month. That’s roughly 1 in every 6,671 pages with no backlinks.
  • Both of the sites they’re on have high Domain Rating (DR) scores. This metric shows the relative strength of a website’s backlink profile. Stronger sites like these have more PageRank that they can pass to pages with internal links to help them rank. 

Bottom line? If you want your pages to get search traffic, you really only have two options:

  1. Target uncompetitive topics that you can rank for with few or no backlinks.
  2. Target competitive topics and build backlinks to rank.

If you want to find uncompetitive topics, try this:

  1. Enter a topic into Keywords Explorer
  2. Go to the Matching terms report
  3. Set the Keyword Difficulty (KD) filter to max. 20
  4. Set the Lowest DR filter to your site’s DR (this will show you keywords with at least one of the same or lower DR ranking in the top 5)
Filtering for low-competition keywords in Ahrefs' Keywords ExplorerFiltering for low-competition keywords in Ahrefs' Keywords Explorer

(Remember to keep an eye on the TP column to make sure they have traffic potential.)

To rank for more competitive topics, you’ll need to earn or build high-quality backlinks to your page. If you’re not sure how to do that, start with the guides below. Keep in mind that it’ll be practically impossible to get links unless your content adds something to the conversation. 

Reason 3. The page doesn’t match search intent

Google wants to give users the most relevant results for a query. That’s why the top organic results for “best yoga mat” are blog posts with recommendations, not product pages. 

It's obviously what searchers want when they search for "best yoga mats"It's obviously what searchers want when they search for "best yoga mats"

Basically, Google knows that searchers are in research mode, not buying mode.

It’s also why this page selling yoga mats doesn’t show up, despite it having backlinks from more than six times more websites than any of the top-ranking pages:

Page selling yoga mats that has lots of backlinksPage selling yoga mats that has lots of backlinks
Number of linking websites to the top-ranking pages for "best yoga mats"Number of linking websites to the top-ranking pages for "best yoga mats"

Luckily, the page ranks for thousands of other more relevant keywords and gets tens of thousands of monthly organic visits. So it’s not such a big deal that it doesn’t rank for “best yoga mats.”

Number of keyword rankings for the page selling yoga matsNumber of keyword rankings for the page selling yoga mats

However, if you have pages with lots of backlinks but no organic traffic—and they already target a keyword with traffic potential—another quick SEO win is to re-optimize them for search intent.

We did this in 2018 with our free backlink checker.

It was originally nothing but a boring landing page explaining the benefits of our product and offering a 7-day trial: 

Original landing page for our free backlink checkerOriginal landing page for our free backlink checker

After analyzing search intent, we soon realized the issue:

People weren’t looking for a landing page, but rather a free tool they could use right away. 

So, in September 2018, we created a free tool and published it under the same URL. It ranked #1 pretty much overnight, and has remained there ever since. 

Our rankings over time for the keyword "backlink checker." You can see when we changed the pageOur rankings over time for the keyword "backlink checker." You can see when we changed the page

Organic traffic went through the roof, too. From ~14K monthly organic visits pre-optimization to almost ~200K today. 

Estimated search traffic over time to our free backlink checkerEstimated search traffic over time to our free backlink checker

TLDR

96.55% of pages get no organic traffic. 

Keep your pages in the other 3.45% by building backlinks, choosing topics with organic traffic potential, and matching search intent.

Ping me on Twitter if you have any questions. 🙂



Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

Firefox URL Tracking Removal – Is This A Trend To Watch?

Published

on

By

Firefox URL Tracking Removal - Is This A Trend To Watch?

Firefox recently announced that they are offering users a choice on whether or not to include tracking information from copied URLs, which comes on the on the heels of iOS 17 blocking user tracking via URLs. The momentum of removing tracking information from URLs appears to be gaining speed. Where is this all going and should marketers be concerned?

Is it possible that blocking URL tracking parameters in the name of privacy will become a trend industrywide?

Firefox Announcement

Firefox recently announced that beginning in the Firefox Browser version 120.0, users will be able to select whether or not they want URLs that they copied to contain tracking parameters.

When users select a link to copy and click to raise the contextual menu for it, Firefox is now giving users a choice as to whether to copy the URL with or without the URL tracking parameters that might be attached to the URL.

Screenshot Of Firefox 120 Contextual Menu

Screenshot of Firefox functionality

According to the Firefox 120 announcement:

“Firefox supports a new “Copy Link Without Site Tracking” feature in the context menu which ensures that copied links no longer contain tracking information.”

Browser Trends For Privacy

All browsers, including Google’s Chrome and Chrome variants, are adding new features that make it harder for websites to track users online through referrer information embedded in a URL when a user clicks from one site and leaves through that click to visit another site.

This trend for privacy has been ongoing for many years but it became more noticeable in 2020 when Chrome made changes to how referrer information was sent when users click links to visit other sites. Firefox and Safari followed with similar referrer behavior.

Whether the current Firefox implementation would be disruptive or if the impact is overblown is kind of besides the point.

What is the point is whether or not what Firefox and Apple did to protect privacy is a trend and if that trend will extend to more blocking of URL parameters that are stronger than what Firefox recently implemented.

I asked Kenny Hyder, CEO of online marketing agency Pixel Main, what his thoughts are about the potential disruptive aspect of what Firefox is doing and whether it’s a trend.

Kenny answered:

“It’s not disruptive from Firefox alone, which only has a 3% market share. If other popular browsers follow suit it could begin to be disruptive to a limited degree, but easily solved from a marketers prospective.

If it became more intrusive and they blocked UTM tags, it would take awhile for them all to catch on if you were to circumvent UTM tags by simply tagging things in a series of sub-directories.. ie. site.com/landing/<tag1>/<tag2> etc.

Also, most savvy marketers are already integrating future proof workarounds for these exact scenarios.

A lot can be done with pixel based integrations rather than cookie based or UTM tracking. When set up properly they can actually provide better and more accurate tracking and attribution. Hence the name of my agency, Pixel Main.”

I think most marketers are aware that privacy is the trend. The good ones have already taken steps to keep it from becoming a problem while still respecting user privacy.”

Some URL Parameters Are Already Affected

For those who are on the periphery of what’s going on with browsers and privacy, it may come as a surprise that some tracking parameters are already affected by actions meant to protect user privacy.

Jonathan Cairo, Lead Solutions Engineer at Elevar shared that there is already a limited amount of tracking related information stripped from URLs.

But he also explained that there are limits to how much information can be stripped from URLs because the resulting negative effects would cause important web browsing functionality to fail.

Jonathan explained:

“So far, we’re seeing a selective trend where some URL parameters, like ‘fbclid’ in Safari’s private browsing, are disappearing, while others, such as TikTok’s ‘ttclid’, remain.

UTM parameters are expected to stay since they focus on user segmentation rather than individual tracking, provided they are used as intended.

The idea of completely removing all URL parameters seems improbable, as it would disrupt key functionalities on numerous websites, including banking services and search capabilities.

Such a drastic move could lead users to switch to alternative browsers.

On the other hand, if only some parameters are eliminated, there’s the possibility of marketers exploiting the remaining ones for tracking purposes.

This raises the question of whether companies like Apple will take it upon themselves to prevent such use.

Regardless, even in a scenario where all parameters are lost, there are still alternative ways to convey click IDs and UTM information to websites.”

Brad Redding of Elevar agreed about the disruptive effect from going too far with removing URL tracking information:

“There is still too much basic internet functionality that relies on query parameters, such as logging in, password resets, etc, which are effectively the same as URL parameters in a full URL path.

So we believe the privacy crackdown is going to continue on known trackers by blocking their tracking scripts, cookies generated from them, and their ability to monitor user’s activity through the browser.

As this grows, the reliance on brands to own their first party data collection and bring consent preferences down to a user-level (vs session based) will be critical so they can backfill gaps in conversion data to their advertising partners outside of the browser or device.”

The Future Of Tracking, Privacy And What Marketers Should Expect

Elevar raises good points about how far browsers can go in terms of how much blocking they can do. Their response that it’s down to brands to own their first party data collection and other strategies to accomplish analytics without compromising user privacy.

Given all the laws governing privacy and Internet tracking that have been enacted around the world it looks like privacy will continue to be a trend.

However, at this point it time, the advice is to keep monitoring how far browsers are going but there is no expectation that things will get out of hand.

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

Trending