Automattic, the corporate behind the open-source WordPress content material administration system, has began drive putting in a safety patch on thousands and thousands of internet sites in the present day to deal with a crucial vulnerability within the Jetpack WordPress plug-in.

Jetpack is an immensely fashionable plug-in that gives free safety, efficiency, and web site administration enhancements, together with web site backups, brute-force assault safety, safe logins, malware scanning, and extra.

Based on the official WordPress plug-in repository, the plug-in is maintained by Automattic, and it now has over 5 million lively installations.

“Throughout an inner safety audit, we discovered a vulnerability with the API accessible in Jetpack since model 2.0, launched in 2012,” Auttomatic Developer Relations Engineer Jeremy Herve stated.

“This vulnerability may very well be utilized by authors on a web site to control any information within the WordPress set up.”

Jetpack 12.1.1, the safety patch presently mechanically rolling out to all WordPress web sites utilizing the plug-in, began rolling out in the present day and has already been put in on greater than 4,130,000 websites utilizing each model of Jetpack since 2.0.

​Which means that most weak web sites have already been mechanically up to date to the most recent safe model, and the remainder will quickly be patched too.

Herve additionally cautioned web site admins that, whereas there aren’t any indicators that the bug has been abused in assaults, they need to make sure that their websites are secured since attackers will probably decide up on the flaw’s particulars and create exploits concentrating on unpatched WordPress web sites.

“We’ve no proof that this vulnerability has been exploited within the wild. Nonetheless, now that the replace has been launched, it’s doable that somebody will attempt to reap the benefits of this vulnerability,” Herve stated.

“Please replace your model of Jetpack as quickly as doable to make sure the safety of your web site. That can assist you on this course of, we’ve labored intently with the WordPress.org Safety Group to launch patched variations of each model of Jetpack since 2.0. Most web sites have been or will quickly be mechanically up to date to a secured model.”

This isn’t the primary time Automattic has used automated deployment of safety updates to patch crucial points in WordPress plug-ins or installations.

For example, WordPress developer Samuel Wooden stated in October 2020 that Automattic has used this strategy to push “safety releases for plug-ins many occasions” since WordPress 3.7 was launched.