The Dutch Data Protection Authority warns that vulnerabilities in WordPress are actively being exploited. Organisations must immediately check which version they are using and update WordPress to the most recent version. They must also investigate whether their system was vulnerable and whether the vulnerability was exploited.
If exploited, attackers can take over the WordPress system and gain access to information about users and administrators, protected website information and personal data processed through the website. This could include forum posts, purchases, quotations, consultations and completed web forms. According to the DPA, the data could be used for spam, targeted phishing and the distribution of malware.
If there are signs of exploitation, organisations must activate their incident response plan as soon as possible. If this may have provided access to personal data, the DPA advises assuming that a personal data breach has occurred and reporting it. A provisional report is possible, so that organisations do not have to wait for an extensive investigation into the exact nature and scope.
Organisations must also assess whether they should inform the people whose personal data have been accessed. If access cannot be ruled out, they must assume the worst-case scenario. In the case of special categories of personal data and large quantities of email addresses or telephone numbers, the DPA advises informing all victims directly and personally as soon as possible.
