You’d think its users would deserve a break at this point, but the discovery of another WordPress vulnerability suggests site owners should be on the lookout for a zero-day flaw that could lead to cross-site scripting attacks.

First disclosed by a security researcher based in Finland, the latest WordPress vulnerability involves a bug that could let cybercriminals inject JavaScript code into the comments field of a site. If a WordPress site administrator approves the comment, which must be 66,000 characters long, it only needs to be viewed once before the code is executed, allowing cybercriminals to take over passwords and admin controls. The vulnerability affects Version 4.2 of the blogging and website platform.

Attackers have tried similar tactics before, and despite the popularity of WordPress, the company behind it hasn’t always been quick to respond. Just a few days ago, a patch was made available for a similar WordPress vulnerability discovered more than a year ago, ThreatPost reported, though in that case, the comment required special characters to execute an attack.

Though a watchful admin could theoretically not approve suspicious comments, there are social engineering techniques to get around such limitations, a story on Ars Technia pointed out. For example, if a clever cybercriminal posted a legitimate comment that was approved, subsequent comments containing the WordPress vulnerability would automatically go live on a site. Then, all it takes is theme editors or plugin tools to let the code injection do its work.

A security researcher confirmed to Forbes that the WordPress vulnerability is a real danger, and though the company said it will offer a patch, there is no real sense of when it will be released. That may lead many site editors to disable comments or at least use plugin tools such as Akismet to minimize the risks.

Chief information security officers and members of IT teams can be forgiven if it is becoming difficult to keep up with every new WordPress vulnerability. Earlier this month, a flaw in a popular plugin called Super Cache left an estimated 1 million sites at risk, while an earlier issue with a plugin used in many WordPress themes was enabling local file inclusion attacks.

Image Source: iStock