--- title: WordPress can't catch a break with vulnerabilities. description: WordPress has been struggling with vulnerabilities for quite a while but a recent one has been finally patched Monday. image: https://blog.uat.edu/hubfs/dims.jfif --- [![image-26](https://blog.uat.edu/hs-fs/hubfs/Marketing/Logos/image-26.png?width=99&name=image-26.png "image-26")](https://www.uat.edu/) ** - [Home](https://www.uattech.com) - [Majors](http://www.uat.edu/advancing-technology-degrees) - [About UAT](https://www.uat.edu/about-uat) - [Request More Information](https://www.uat.edu/request-info) [![Take a Virtual, Interactive Tour ](https://no-cache.hubspot.com/cta/default/3455363/92ff0e66-7821-430b-88c3-a32c82c5bda2.png)](https://cta-redirect.hubspot.com/cta/redirect/3455363/92ff0e66-7821-430b-88c3-a32c82c5bda2) # What's happening on UAT's campus- A blog published by UAT Students. ALL CATEGORIES - [all Categories](https://blog.uat.edu) - [ Advancing Computer Science ](https://www.uattech.com/tag/advancing-computer-science) - [ Advertising Art ](https://www.uattech.com/tag/advertising-art) - [ Artificial Intelligence ](https://www.uattech.com/tag/artificial-intelligence) - [ Business Technology ](https://www.uattech.com/tag/business-technology) - [ Cyber Security ](https://www.uattech.com/tag/cyber-security) - [ Data Science ](https://www.uattech.com/tag/data-science) - [ Digital Maker and Fabrication ](https://www.uattech.com/tag/digital-maker-and-fabrication) - [ Digital Marketing ](https://www.uattech.com/tag/digital-marketing) - [ Digital Video ](https://www.uattech.com/tag/digital-video) - [ Game Studies ](https://www.uattech.com/tag/game-studies) - [ Human Computer Interaction ](https://www.uattech.com/tag/human-computer-interaction) - [ Robotics and Embedded Systems ](https://www.uattech.com/tag/robotics-and-embedded-sytems) - [ Software Engineering ](https://www.uattech.com/tag/software-engineering) - [ Virtual Reality ](https://www.uattech.com/tag/virtual-reality) - [ Alumni ](https://www.uattech.com/tag/alumni) - [ Behind the Bits Magazine ](https://www.uattech.com/tag/behind-the-bits) - [ Career and Work ](https://www.uattech.com/tag/career-and-work) - [ Competitions ](https://www.uattech.com/tag/competitions) - [ Events ](https://www.uattech.com/tag/events) - [ Geek411 Magazine ](https://www.uattech.com/tag/geek-411) - [ Graduate Studies ](https://www.uattech.com/tag/graduate-studies) - [ Military ](https://www.uattech.com/tag/military) - [ People, Places and Things ](https://www.uattech.com/tag/people-places-and-things) - [ Perimeter83 ](https://www.uattech.com/tag/Perimeter83) - [ Student Innovation Project (SIP) ](https://www.uattech.com/tag/student-innovation-project) - [ Student Work ](https://www.uattech.com/tag/student-work) - [ Technology News ](https://www.uattech.com/tag/technology-news) - [ UAT Life ](https://www.uattech.com/tag/UAT-life) - [ UAT News ](https://www.uattech.com/tag/UAT-news) [Cyber Security](https://blog.uat.edu/tag/cyber-security)   |   3 Min Read ## WordPress can't catch a break with vulnerabilities. ![Picture of Marcos Xochihua](https://blog.uat.edu/hubfs/thumbnail_Image.jpg) [ Written by Marcos Xochihua ](https://blog.uat.edu/author/marcos-xochihua) Seems like WordPress can't catch a break. Another zero-day vulnerability in a plugin for WordPress which has been installed in more than 500,000 sites. In this particular vulnerability, it allows hackers to reset passwords for admin accounts.   ![dims](https://blog.uat.edu/hubfs/dims.jfif) This vulnerability was used for weeks on end and thankfully was patched Monday. It was able to impact Easy WP SMTP which is a plugin to let site owners to configure SMTP settings for outgoing emails. A company called Ninja Technologies Network or NinTechNet for short. They state that Easy WP SMTP 1.4.2 and older versions have a feature that creates debug logs for all emails and is stored in the installation folder. "The plugin's folder doesn't have any index.html file, hence, on servers that have directory listing enabled, hackers can find and view the log," said NinTechNet's Jerome Bruandet. He also says that sites still running on these outdated versions the hackers have been able to automate the attacks to identify the admin account and do a password reset. Since a password reset involves sending an email with the password reset link to the account, that very email is displayed in the Easy WP SMTP debug log. So, the attacker can grab the reset link and take over the account. "This vulnerability is currently exploited, make sure to update as soon as possible to the latest version," Bruandet warned earlier this week on Monday. Now there is Easy WP SMTP 1.4.4 which the developers found a workaround for the vulnerability by moving the debug logs into the WordPress logs folder. This is now the second vulnerability as the first one was found back in March of 2019 with the same plugin.  That vulnerability allowed backdoors on accounts. While it's an unfortunate situation this time with WordPress 5.5 where it has an auto-update feature, so an admin doesn't need to update it manually. But the question is if those sites are updated and have the auto-update feature enabled. Hopefully a good admin who checks and updates regularly enable the auto-update to avoid this plugin mess. - [** ](https://www.facebook.com/sharer/sharer.php?u=https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities&title=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.&picture=https://learn.uat.edu/hubfs/dims.jfif&description=WordPress%20has%20been%20struggling%20with%20vulnerabilities%20for%20quite%20a%20while%20but%20a%20recent%20one%20has%20been%20finally%20patched%20Monday.) - [** ](https://twitter.com/intent/tweet?source=https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities&text=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.) - [** ](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities&title=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.&summary=WordPress%20has%20been%20struggling%20with%20vulnerabilities%20for%20quite%20a%20while%20but%20a%20recent%20one%20has%20been%20finally%20patched%20Monday.) - [** ](mailto:?subject=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.&body=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.%20https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities) ### Don't forget to share this post! - [** ](https://www.facebook.com/sharer/sharer.php?u=https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities&title=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.&picture=https://learn.uat.edu/hubfs/dims.jfif&description=WordPress%20has%20been%20struggling%20with%20vulnerabilities%20for%20quite%20a%20while%20but%20a%20recent%20one%20has%20been%20finally%20patched%20Monday.) - [** ](https://twitter.com/intent/tweet?source=https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities&text=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.) - [** ](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities&title=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.&summary=WordPress%20has%20been%20struggling%20with%20vulnerabilities%20for%20quite%20a%20while%20but%20a%20recent%20one%20has%20been%20finally%20patched%20Monday.) - [** ](mailto:?subject=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.&body=WordPress%20can't%20catch%20a%20break%20with%20vulnerabilities.%20https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities) ### Comment ## Related Articles [Cyber Security](https://blog.uat.edu/tag/cyber-security) [UAT News](https://blog.uat.edu/tag/uat-news) ### [FBI Cyber Academy at UAT Inspires the Next Generation of Cyber Defenders](https://blog.uat.edu/fbi-cyber-academy-at-uat-inspires-the-next-generation-of-cyber-defenders) [![Picture of Jake Henningsen](https://blog.uat.edu/hubfs/Fabcom_UATPortraits20245216-MOD.jpg) Jake Henningsen ](https://blog.uat.edu/author/jake-henningsen) 3 Min Read [UAT clubs](https://blog.uat.edu/tag/uat-clubs) [Cyber Security](https://blog.uat.edu/tag/cyber-security) ### [UAT Cyber Ninjas: Cyber Club and Competition Team](https://blog.uat.edu/uat-cyber-ninjas-cyber-club-and-competition-team) At University of Advancing Technology (UAT), the Cyber Ninjas competition team stands as a cornerstone of our cybersecurity community. We're more than just a club—we are a diverse group of passionate ... [![Picture of Ozzy James](https://blog.uat.edu/hubfs/97-IMG_2774.jpg) Ozzy James ](https://blog.uat.edu/author/ozzy-james) 3 Min Read [Events](https://blog.uat.edu/tag/events) [Artificial Intelligence](https://blog.uat.edu/tag/artificial-intelligence) ### [TechFusion Conference: A Transformative Involvement for Students](https://blog.uat.edu/techfusion-conference-a-transformative-involvement-for-students) University of Advancing Technology (UAT) Cyber Security Student Alexis Sloan attended the AZ Tech Council Event on Tuesday March 25th. She discusses the opportunities and learning experience the ... [![Picture of Alexis Sloan](https://blog.uat.edu/hubfs/0823_UAT%20Wordmark%20EXL-69.jpg) Alexis Sloan ](https://blog.uat.edu/author/alexis-sloan) 3 Min Read [![UAT-Logo-new](https://blog.uat.edu/hs-fs/hubfs/Logos,%20Buttons,%20Icons%20(Non%20UAT)/UAT-Logo-new.jpg?width=151&name=UAT-Logo-new.jpg "UAT-Logo-new")](https://www.uat.edu/) UAT Tech is a blog by the University of Advancing Technology - [** ](https://www.instagram.com/uatedu) - [** ](https://twitter.com/uatedu) - [** ](https://www.linkedin.com/company/uatedu) - [** ](https://www.youtube.com/user/UATProductions) Want More? - [Learn More About UAT](https://www.uat.edu/request-info) - [Apply Now](https://uatfastapp.com/) - [Student Life Blog](https://blog.uat.edu/) Contact Us **Email: [ admissions@uat.edu ](mailto:admissions@uat.edu) **Phone: [ +1 800-658-5744 ](tel:+1%20800-658-5744) **Address: 2625 W Baseline Rd, Tempe, AZ 85283 Copyright @ 2026.The University of Advancing Technology. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Marcos Xochihua", "url" : "https://blog.uat.edu/author/marcos-xochihua" }, "dateModified" : "2021-01-27T18:34:23.848Z", "datePublished" : "2020-12-11T18:34:00.000Z", "headline" : "WordPress can't catch a break with vulnerabilities.", "image" : [ "https://blog.uat.edu/hubfs/dims.jfif" ], "mainEntityOfPage" : { "@id" : "https://blog.uat.edu/wordpress-cant-catch-a-break-with-vulnerabilities", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.uat.edu/hubfs/front%20no%20shadow-2.png" }, "name" : "University of Advancing Technology" } } ```