Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

random_savv · 1790102014 · focus · HN ↗
I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!
1. themeiguoren · 1790106149 · focus · HN ↗
  Is there a good replacement for wordpress comments? That's the one thing holding me back from porting at the moment.
  1. iLoveOncall · 1790106594 · focus · HN ↗
    I think you can render Disqus on static websites, but Disqus is its own piece of crap so not sure you'd want to.
  2. janvdberg · 1790106623 · focus · HN ↗
    Yes! <a href="https://comments.purecommons.org/" rel="nofollow">https://comments.purecommons.org/
  3. karthikeyankc · 1790116009 · focus · HN ↗
    I had the same itch when I ported my personal blog from WordPress to Astro. I built a fully customisable self-hosted comment system called Discuss. It's got a dashboard and tokenized UI customisation. Pretty light weight too. It's available here - <a href="https://github.com/karthikeyankc/discuss" rel="nofollow">https://github.com/karthikeyankc/discuss . Do give it a spin or fork it. Would love to hear your feedback.
    alok-g · 1790135093 · focus · HN ↗
    Looks nice.
    My website is hosted on 1and1 via PHP. I am guessing that this would not work for me as installation needs server access. Moving to VPS, along with transferring domain, would require more time than I would like to spend. Thanks.
    karthikeyankc · 1790141921 · focus · HN ↗
    Ah okay, yeah, you'd need server access. Perhaps a one click install to cloudflare or vercel could've helped you. They offer generous free tiers and for personal blogs that should be good enough. But if your website has high traffic, free tiers might not work thou. Either way, this flexibility should help others like you. I'll see if I can work on one-click setups for cf and vercel this weekend. Thanks for checking it out.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.