During a recent investigation, the team at Sucuri have identified malware that collects sensitive data currently spreading to target WooCommerce websites in compromised hosting environments.

The malware is spread via an ongoing wave of exploits against vulnerable WordPress plugins. Check here for the list of plugins: https://labs.sucuri.net/vulnerabilities-digest-april-2020/

For more information please check the official public release.

For websites at risk, it is recommended to run a server-side scanner that can monitor the filesystem for changes so that the presence of the malware is detected.

Beyond that, it is recommended to update your themes and plugins to their latest versions and ensure that your host is using the latest stable version of PHP.

If you have questions, don’t hesitate to contact our support team.

The Wordfence team reports at least 130 million attacks were detected between May 29 to May 31, 2020. The attacks were intended to harvest a website’s database credentials by downloading the configuration files.

Most of the attacks were targeted at the vulnerabilities in outdated plugins and/or themes that allow files to be downloaded or exported.

To confirm whether your website has been compromised, check your server logs and look for any entries containing wp-config.php in the query string that returned a 200 response code.

Here are the top 10 attacking IP addresses in this campaign:

200.25.60.53
51.255.79.47
194.60.254.42
31.131.251.113
194.58.123.231
107.170.19.251
188.165.195.184
151.80.22.75
192.254.68.134
93.190.140.8

Sites running the Wordfence plugin should be safe from these attacks. If you believe your website has been compromised, change your database password, and authentication unique keys and salts immediately.

For more information please check the official public release.

Beyond that, it is strongly recommended to update your themes and plugins to their latest versions and ensure that your host is using the latest stable version of PHP.

If you have questions, don’t hesitate to contact our support team.

WordPress version 5.4.2 has now been released.

This is a security and maintenance release so it is recommended to update to this version as soon as possible, especially if you are experiencing any bugs on your current WordPress version.

WP version 5.4.2 features 23 fixes and enhancements, plus a number of security fixes affecting WordPress versions 5.4.1 and earlier.

For more information please check the official public release.

If you have questions, don’t hesitate to contact our support team.

WooCommerce 4.1 release

WooCommerce 4.1 is now available. It has been in development since March 2020 and has around 400 commits from 28 contributors. This release focuses on various performance improvements and stability fixes.

For more information please check the official public release.

Storefront 2.5.6 release

Storefront 2.5.5 is now available on WordPress.org. This is a minor release that contains several maintenance and compatibility fixes for existing issues.

For more information please check the official public release.

These are minor releases so there’s no need for an immediate update. But if you have existing issues with WooCommerce and/or Storefront, these releases might fix your issue. When you update, make sure to do thorough testing after.

If you have questions, don’t hesitate to contact our support team

WooCommerce 4.2 release

WooCommerce 4.2 is now available. In development since April 2020, it has about 294 commits from 28 contributors.

This is a backwards-compatible minor release focusing on stability and performance.

For more information, please check the official public release.

Storefront 2.5.7 release 

Storefront 2.5.7 has been tagged for release and uploaded to WordPress.org.

This is a small maintenance release.

For more information, please check the official public release.

These are minor releases so there’s no need for an immediate update. But if you have existing issues with WooCommerce and/or Storefront, you may update whenever suitable. Make sure to do thorough testing after.

If you have questions, don’t hesitate to contact our support team