WordPress Log4j Exploits: Are Your Clients’ Sites Safe?

Undoubtedly, you’ve heard the news about the recent discovery of an exploit centered around something called Log4J. This issue has hit mainstream television, newspapers, and every form of media. It’s become so well-known, in such a very short time, that you might have heard your friends and family asking about it. Anyone who does any kind of web design or web development work has most definitely had clients ask them about Log4J as well. Today we’re going to go over what exactly Log4j is, how the exploit works, and whether or not your WordPress clients are in danger. In the end, you should have a better understanding of the truth behind WordPress Log4j exploits and how they impact the world’s most popular content management system.

---

What Is Log4j?

Log4j is a very popular logging library for the Java programming language. Written and maintained by the Apache Software Foundation., Log4j appears in a variety of software applications to collect and store events. In short, a logging library lets a developer collect information about a particular process or user and save it for later use. These uses can be for other features of an application, for various kinds of reporting, or to simply help with development by monitoring for errors.

---

What Is the Log4j Exploit?

The Log4j exploit, specifically called CVE-2021-44228 but commonly referred to as Log4Shell, is a zero-day vulnerability that allowed for unintended code execution. Since Log4j allows for storing user input (again, it’s common practice to log these kinds of things in a lot of applications) it needs to be sure that input isn’t actionable. Unfortunately, the Log4Shell vulnerability allows for the remote execution of code if the user input that is logged is formatted in a very specific way.

This exploit allows malicious users to inject text via Log4J and then execute code on a remote address. Some common applications of this technique are to force devices to unknowingly mine cryptocurrency, send spam emails, and do other underhanded things.

News of the exploit came to the Apache Software Foundation’s attention on November 24th, 2021, but the vulnerability had been in the wild since 2013. On December 6th, 2021, a fix for the exploit went out but the crisis doesn’t end there. The amount of software using Log4j is quite vast. It will take quite a while for all of these applications to correct this issue internally. In the meantime, abuse of the exploit will be running rampant.

---

Is WordPress Impacted by Log4j?

Finally, to the discussion about WordPress Log4j problems.

This entire post has essentially been nothing but bad news for the Internet. Log4j is very popular in the Java programming community. Many high-profile applications use the library. Fortunately, PHP, and not Java, is the programming language of WordPress. This means that your clients’ WordPress sites are safe in most circumstances.

The only thing you should check is to see if, for some reason, your WordPress sites connect or interact with any Java-based applications on the same server. The chances of this are rare if you are working with standard WordPress installation. We recommend you check anyway just to be safe. If you are unsure, contacting your hosting provider is a good place to start to get confirmation.

It’s important to remember that this issue does not impact the Apache webserver. This is important to know because many WordPress sites run on Apache-powered servers. While Log4J is part of the Apache Software Foundation it is separate from the web server application. In addition, you might see some references to something called Log4js in some of your WordPress plugins or server architecture. This is a Javascript library and not related to the exploit. It just has a very similar name.

---

This Isn’t the End of Log4j

We are most likely going to be dealing with the fallout of Log4j for many months to come. Thankfully, if you run a WordPress-focused business, the news is good. The odds are small that your clients and work are affected. WordPress runs on the PHP programming language, and not Java, so the likelihood of there being a problem is tiny. Just remember there is a chance your server might contain Java software that interacts with your WordPress installation. This would most likely be a custom setup you are aware of though so act accordingly.

Thank you for reading this article. If you would like to learn more about WordPress and running a WordPress business check out our blog. We regularly write articles and guides on how to get the best out of WordPress for your projects. We also have a popular plugin called White Label that lets you customize the WordPress admin experience for your clients. Check it out if you run a WordPress-focused client business.

---

Related Posts from Our WordPress Blog