Patch the exploited vulnerability in your CMS or application
Why it matters
An advisory that covers your visible version is on CISA's list of vulnerabilities attackers are using in the wild, so unpatched sites are being hit. It may already be fixed, because hosts back-port fixes without changing the version number, but check it today.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Check today which version you really run (admin panel, package manager or host) and whether the vendor's advisory for the named CVE says that release is fixed. Ask your host if it patches without a version change.
- If it is not fixed, take a backup and apply the patched release or the vendor's workaround right away, on staging first if you can do that quickly. Then rescan.
- Look for signs that the site was already attacked, because exploitation may have happened before the patch. Check for unknown administrator accounts, files changed recently outside your deployments, unexpected scheduled jobs and strange outbound traffic. If anything looks wrong, restore a known good backup, rotate all passwords and keys, and ask your host or a specialist for help.
- If you cannot patch within a day, reduce exposure while you plan it, for example by limiting access to the admin area or enabling a firewall rule that the vendor or your CDN provides for this vulnerability.
Related
Scan your domain to see whether this applies to you.