How to use world press file manager

Hello friends

WordPress File Manager vulnerability—actions and advice

Sep 10, 2020 - written by Anaïs in Domain names

A “zero-day” vulnerability was recently discovered in the “File Manager” plugin widely used by the WordPress community. As a result, millions of WordPress sites have been attacked so far this month.

File Manager: the plugin in question

At the beginning of September, a vulnerability was discovered and widely exploited in version 6.4 of the WordPress plugin File Manager. This plugin is used as an FTP transfer application to send content to a WordPress site. The vulnerability stemmed from a file initially used for development and added to the project accidentally.

This vulnerability potentially allows a non-authenticated user to execute commands on the site and thereby to take control.

That’s why we thought it necessary to remind you of the steps to take to protect

Be active and act now.

Here are the steps you should take in response to this vulnerability:

Verify whether you use the File Manager plugin

To do that, go to the “Plugins” section in your WordPress administrative interface.

If not, you’re not impacted

If yes, update this plugin immediately to the most recent available version.

The last version of the plugin (6.9) resolves this vulnerability. These updates are directly visible in the “Plugins” tab of the WordPress administrative interface. Once the new version of the plugin is installed, your WordPress site will no longer be vulnerable.

However, due to WordPress’s popularity and the many plugins available, vulnerabilities of this type are common and are even increasingly so. To protect yourself, we suggest following some best practices and implementing a regular security routine for your website.

Best practices

Be careful when choosing WordPress plugins.

One of the advantages of WordPress rests in its almost complete catalog of add ons, but these plugins are not without risk.

For the plugins, you use, make sure you use the latest version of each and ensure that they haven’t recently been attacked by checking the developer’s website.

1. Choose plugins that are regularly updated

Don’t overload your WordPress site with plugins that aren’t necessary. It’s neither suitable for your security or your website’s performance or its SEO. Feel free to remove any plugins you don’t use.

2. Activate snapshots on your Simple Hosting instance

Photos let you store a previous state of the files on your model. This can be useful if you need to return to an earlier state if you make a mistake in configuring your website.

You can activate snapshots for free on Simple Hosting [ link: https://www.gandi.net/en/simple-hosting ] from your Gandi admin space.

Read more about snapshots ( https://docs.gandi.net/en/simple_hosting/common_operations/snapshots.html )

As a reminder, snapshots are stored in the same place as your site. For this reason, it can never replace a truly complete backup strategy, which would involve storing backups off-site.

3. Regularly backup your entire Simple Hosting instance

Whatever your hosting solution, you need to have a complete backup of your data at a separate location. For a website, it’s helpful to have a local copy on your desktop, for example. To be efficient, the backup should consist of two elements:

The database:

For WordPress, this would be a MySQL database. It’s recommended to do a complete export of your database. This can be done via the PhpMyAdmin interface that manages the MySQL database of your Simple Hosting instance. You can access PhpMyAdmin from the “Administration” tab of your Simple Hosting example. The export creates a file by default named ‘localhost.sql’ that you can save on your computer.

If you want to rest more accessible, this export can also be automated daily.

Your website files:

Consider regularly copying all of your website data by connecting to sFTP, for example, with FileZilla.

4. Follow the news on the security of the tools you use

Most principal software developers have their dedicated communication channels to help users stay on top of communications about security problems. If some tools have become essential for your sites and your customers, it’s crucial that you be quickly alerted to any potential problems.

For WordPress: https://wordpress.org/news/category/security/

Feel free to follow us on Twitter and Facebook to be kept informed of these types of incidents.