WP Cerber Security 6.2
Protection against a denial of service (DoS) attack that exploits recently discovered vulnerability (CVE-2018-6389). It’s not a critical vulnerability and doesn’t allow a hacker to break into a victim website. It’s rather a flaw that allows anyone to put a WordPress powered website to its knees easily. Bad actors can use it to bring a website down. The attack can be initiated from any computer by anyone. No special knowledge or software is needed.
The protection mechanism is disabled by default. To enable it go to the Hardening tab and enable Block unauthorized access to load-scripts.php and load-styles.php. After enabling this setting a set of security rules will be added to the .htaccess file.
- The Traffic Inspector algorithm detects malformed and double extensions like .php.jpg more precisely.
- Access Lists now accept IPv6 addresses in any form. You can enter a shortened IPv6 (short form) or a full IPv6. A full IPv6 will be shortened to the short IPv6 address representation. All existing in access lists IP addresses will be converted.
- If REST API is blocked, a request with specially malformed URL can bypass protection. Thanks to Tomasz Wasiak.
- An IPv4 range in the Access Lists might not work as expected, depending on server/site settings.
Read more about CVE-2018-6389
Last posts from WordPress security blog
- How to clean up activity and live traffic logs February 16, 2018
- How to protect WordPress against CVE-2018-6389 DoS attacks February 11, 2018
- WP Cerber Security 6.2 February 7, 2018
- Traffic Inspector and logging how to February 5, 2018
- Development version 6.1.3 February 1, 2018