IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

WordPress suffers root level hack

WordPress source code may be in the hands of the bad guys, after the blogging service saw its servers hacked.

WordPress

WordPress.com was on the wrong end of a root level attack this week, although the fallout could have been significantly worse than it was, according to a security expert.

Hackers gained root level access to servers at WordPress' parent company Automattic, meaning "potentially anything on those servers could have been revealed," WordPress founder Matt Mullenweg admitted on a blog.

He presumed the WordPress source code was copied by hackers, but it appeared "information disclosed was limited."

Mullenweg said there was no evidence user passwords had been taken.

Despite the serious implications of the compromise, one security expert claimed the aftermath could have been much worse for WordPress.

"Although the hackers would have been able to download much of the source code on the servers, possibly including custom-developed code of premium clients of the company, WordPress appears to have followed best practice and encrypted the password files, as well as private information such as credit card details," said Phil Lieberman, president of identity management specialist Lieberman Software.

"Media reports over the last day or so have played up the hack as if it is the end of the world for the blogging industry, when it plainly isn't. By encrypting user credentials and associated data, WordPress has followed the advice of the IT security professionals," he added.

WordPress was hit by another hack attack just last month, when a huge Distributed Denial of Service (DDoS) strike caused "sporadic slowness" on the site.

"This time around, it looks as though the company has taken a sensible approach to security and reasoned that, even if hackers get through its external defences, as has clearly happened, they can limit the damage that has been done," Lieberman added.

"Other high-profile organisations should take notice [of] this planned defensive strategy."

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
Attracting and retaining talent through training
Sponsored

Attracting and retaining talent through training

13 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022