For those who missed the issue when it came up earlier this year, here is a refresher, since the topic has been in the news again this month.
HERE ARE THE FACTS AS I POSTED LAST AUGUST:
The version of the Themepunch Revolution Slider plugin which was first included with Newspaper “4” was “Version 4.3.8 SkyWood”; and Themepunch told me personally that the vulnerability only existed in version 4.1.4 and older/earlier (which is the version included with Newspaper “3”).
So, if you’re using Revolution Slider 4.1.4 or higher, or using Newspaper “4” you are fine. If you are still using Newspaper “3” you likely have the “bad” version of the plugin. Sadly, Themepunch did a poor job of making people aware of this issue.
Also general rule of thumb and best practices is to REMOVE any plugins you ARE NOT USING from your WordPress install. They only bog down the system, and may prove to be an exploit later on if not secure to begin with.
Admin, you may want to “sticky” this or add to theme docs for the issue coming up again. 🙂
Slight correction to how I wrote that — if you’re using versions NEWER than 4.14 then you are fine.
