The website security firm Sucuri earlier this month disclosed a critical issue in Akismet, an anti-spam plugin used by millions users of the WordPress content management system. Sucuri notified Automattic (parent company of WordPress) of this issue earlier this month. Sucuri only disclosed the issue after an update was made available.
Why Should This Issue Be Considered Important?
A critical cross-site scripting (XSS) issue (defined) was found within Akismet caused by how it handles hyperlinks (links to other websites) placed within blog comments. This could allow an unauthenticated attacker (namely an attacker that does not have any prior access to your WordPress website) to insert malicious scripts into the Comment section of the WordPress administration panel. The most serious consequence of this would be a full website compromise. Further details of this vulnerability are provided within Sucuri’s advisory.
How Can I Protect Myself From This Issue?
Please update to version 3.1.5 of Akismet using the steps provided in this Akismet blog post.