Thread

1. tptacek · 1790096527 · focus · HN ↗

   These CVSS scores don't mean anything and it would be better for everyone if they stopped showing up in headlines. This is a somewhat situational Wordpress RCE that impacts only a couple themes.

   1. TZubiri · 1790101830 · focus · HN ↗

      It's crazy how many users are standing by this take. Not only is a 9.8 CVSS critical, even if it doesn't affect your config, you should trash any dependency that has so many 9+CVSS vulns that you become numb to them.

      When you use a dependency and a 9+CVSS vuln comes out, you read it and respect it. If you come to the conclusion that CVSS don't mean anything because there's just so many vulns, that's saying something of the dependency and your security posture.

      Burn Wordpress with a flemmenwerfer, or build a hard virtualization layer around it, give it its own scoped certs, your Wordpress things will get hacked, especially if they use plugins.

Unofficial Hacker News client; not affiliated with Y Combinator.