-
A bad week for WordPress. Why our sites didn't care.
A flaw that hands hackers your website, your data and your customers' details, serious enough that governments took sites offline, and two popular WordPress plugins turned into back doors. What happened, the five questions to ask whoever looks after your site, and why none of the sites we build needed a thing doing.
securitywordpressphp
-
Your authorisation layer is correct and your query still leaks
A permission check answers "may this user do this". It doesn't answer "to which rows". In multi-tenant software the second question is the one that leaks data, and it fails in a way that passes every test you've written.
gosecuritymulti-tenancypostgres