5 Million WordPress Sites Forced to Update for Jetpack Plugin

The Automattic developers and the WordPress security team are deploying a forced security update to millions of sites with the Jetpack plugin installed.

Let me remind you that we also wrote that 1.2 million WordPress site owners were affected by the GoDaddy data breach, and information security specialists also reported that Hackers Scanned 1.6 Million WordPress Sites Looking for a Vulnerable Plugin.

With nearly 5 million installations, Jetpack provides users with free security, performance, and site management features, including brute-force protection, backup, secure login, and malware scanning. Automattic itself created and maintained the plugin.

The patch was included in Jetpack 12.1.1 and this version was automatically distributed to all WordPress sites using the plugin. According to official statistics, the rollout of the update has already been successfully completed, and most sites are now automatically updated to the latest secure version.

Automattic engineers warn that although no signs of exploitation of the vulnerability have been found, attackers are likely to learn the details of the problem soon and create exploits to attack unpatched sites.