If your business website runs on WordPress – and a large share of small business sites do – it needs a security update now.
On 28 October, WordPress released version 7.1.4. WordPress itself calls it a security release and recommends updating sites immediately. It fixes more than a dozen security issues. The most serious is a weakness in the update process itself that can let an attacker run their own code on the website while an update is under way.
Why this one matters
According to security news site The Hacker News, there were nearly 63,000 attempts to exploit this flaw within 24 hours, shortly after the fix was published. That is the usual pattern: once a fix is public, criminals study it and go looking for websites that have not applied it. The report counts attempts, not confirmed break-ins, but it shows how quickly old versions become targets.
The flaw affects WordPress versions 4.7 through 7.1.3, so sites that have not been touched in years are in scope as well. WordPress says fixes are also being prepared for those older versions, but that work is still in progress.
What to do this week
- Check your version. Log in to your WordPress dashboard and open Dashboard > Updates. You want 7.1.4, or a security update for your older version.
- Do not assume automatic updates ran. Many sites update themselves, but some have it switched off, often by whoever built the site. Confirm it happened.
- Ask whoever looks after your site. If a web developer or hosting company manages it, ask them in writing whether this update has been applied.
- Update plugins and themes too, and make sure you have a recent backup stored somewhere other than the website itself.
A website that nobody is responsible for is one of the most common ways small businesses get caught out. Your site is your shopfront, and an attacker who controls it can use it to scam your own customers.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.