Google adds an AI “Flight Deals” tool to Google Flights, part of a broader push into vertical, conversational search experiences.
https://www.searchenginejournal.com/google-brings-ai-trip-finding-to-google-flights/553702/
AI tools can do a lot of SEO now. Draft content. Suggest keywords. Generate metadata. Flag potential issues. We’re well past the novelty stage.
But for all the speed and surface-level utility, there’s a hard truth underneath: AI still gets things wrong. And when it does, it does it convincingly.
It hallucinates stats. Misreads query intent. Asserts outdated best practices. Repeats myths you’ve spent years correcting. And if you’re in a regulated space (finance, healthcare, law), those errors aren’t just embarrassing. They’re dangerous.
The business stakes around accuracy aren’t theoretical; they’re measurable and growing fast. Over 200 class action lawsuits for false advertising were filed annually from 2020-2022 in just the food and beverage industry alone, compared to 53 suits in 2011. That’s a 4x increase in one sector.
Across all industries, California district courts saw over 500 false advertising cases in 2024. Class actions and government enforcement lawsuits collected more than $50 billion in settlements in 2023. Recent industry analysis shows false advertising penalties in the United States have doubled in the last decade.
This isn’t just about embarrassing mistakes anymore. It’s about legal exposure that scales with your content volume. Every AI-generated product description, every automated blog post, every algorithmically created landing page is a potential liability if it contains unverifiable claims.
And here’s the kicker: The trend is accelerating. Legal experts report “hundreds of new suits every year from 2020 to 2023,” with industry data showing significant increases in false advertising litigation. Consumers are more aware of marketing tactics, regulators are cracking down harder, and social media amplifies complaints faster than ever.
The math is simple: As AI generates more content at scale, the surface area for false claims expands exponentially. Without verification systems, you’re not just automating content creation, you’re automating legal risk.
What marketers want is fire-and-forget content automation (write product descriptions for these 200 SKUs, for example) that can be trusted by people and machines. Write it once, push it live, move on. But that only works when you can trust the system not to lie, drift, or contradict itself.
And that level of trust doesn’t come from the content generator. It comes from the thing sitting beside it: the verifier.
Marketers want trustworthy tools; data that’s accurate and verifiable, and repeatability. As ChatGPT 5’s recent rollout has shown, in the past, we had Google’s algorithm updates to manage and dance around. Now, it’s model updates, which can affect everything from the actual answers people see to how the tools built on their architecture operate and perform.
To build trust in these models, the companies behind them are building Universal Verifiers.
A universal verifier is an AI fact-checker that sits between the model and the user. It’s a system that checks AI output before it reaches you, or your audience. It’s trained separately from the model that generates content. Its job is to catch hallucinations, logic gaps, unverifiable claims, and ethical violations. It’s the machine version of a fact-checker with a good memory and a low tolerance for nonsense.
Technically speaking, a universal verifier is model-agnostic. It can evaluate outputs from any model, even if it wasn’t trained on the same data or doesn’t understand the prompt. It looks at what was said, what’s true, and whether those things match.
In the most advanced setups, a verifier wouldn’t just say yes or no. It would return a confidence score. Identify risky sentences. Suggest citations. Maybe even halt deployment if the risk was too high.
That’s the dream. But it’s not reality yet.
Industry reporting suggests OpenAI is integrating universal verifiers into GPT-5’s architecture, with recent leaks indicating this technology was instrumental in achieving gold medal performance at the International Mathematical Olympiad. OpenAI researcher Jerry Tworek has reportedly suggested this reinforcement learning system could form the basis for general artificial intelligence. OpenAI officially announced the IMO gold medal achievement, but public deployment of verifier-enhanced models is still months away, with no production API available today.
DeepMind has developed Search-Augmented Factuality Evaluator (SAFE), which matches human fact-checkers 72% of the time, and when they disagreed, SAFE was correct 76% of the time. That’s promising for research – not good enough for medical content or financial disclosures.
Across the industry, prototype verifiers exist, but only in controlled environments. They’re being tested inside safety teams. They haven’t been exposed to real-world noise, edge cases, or scale.
If you’re thinking about how this affects your work, you’re early. That’s a good place to be.
This is where it gets tricky. What level of confidence is enough?
In regulated sectors, that number is high. A verifier needs to be correct 95 to 99% of the time. Not just overall, but on every sentence, every claim, every generation.
In less regulated use cases, like content marketing, you might get away with 90%. But that depends on your brand risk, your legal exposure, and your tolerance for cleanup.
Here’s the problem: Current verifier models aren’t close to those thresholds. Even DeepMind’s SAFE system, which represents the state of the art in AI fact-checking, achieves 72% accuracy against human evaluators. That’s not trust. That’s a little better than a coin flip. (Technically, it’s 22% better than a coin flip, but you get the point.)
So today, trust still comes from one place: A human in the loop, because the AI UVs aren’t even close.
Here’s a disconnect no one’s really surfacing: Universal verifiers won’t likely live in your SEO tools. They don’t sit next to your content editor. They don’t plug into your CMS.
They live inside the LLM.
So even as OpenAI, DeepMind, and Anthropic develop these trust layers, that verification data doesn’t reach you, unless the model provider exposes it. Which means that today, even the best verifier in the world is functionally useless to your SEO workflow unless it shows its work.
Here’s how that might change:
Verifier metadata becomes part of the LLM response. Imagine every completion you get includes a confidence score, flags for unverifiable claims, or a short critique summary. These wouldn’t be generated by the same model; they’d be layered on top by a verifier model.
SEO tools start capturing that verifier output. If your tool calls an API that supports verification, it could display trust scores or risk flags next to content blocks. You might start seeing green/yellow/red labels right in the UI. That’s your cue to publish, pause, or escalate to human review.
Workflow automation integrates verifier signals. You could auto-hold content that falls below a 90% trust score. Flag high-risk topics. Track which model, which prompt, and which content formats fail most often. Content automation becomes more than optimization. It becomes risk-managed automation.
Verifiers influence ranking-readiness. If search engines adopt similar verification layers inside their own LLMs (and why wouldn’t they?), your content won’t just be judged on crawlability or link profile. It’ll be judged on whether it was retrieved, synthesized, and safe enough to survive the verifier filter. If Google’s verifier, for example, flags a claim as low-confidence, that content may never enter retrieval.
Enterprise teams could build pipelines around it. The big question is whether model providers will expose verifier outputs via API at all. There’s no guarantee they will – and even if they do, there’s no timeline for when that might happen. If verifier data does become available, that’s when you could build dashboards, trust thresholds, and error tracking. But that’s a big “if.”
So no, you can’t access a universal verifier in your SEO stack today. But your stack should be designed to integrate one as soon as it’s available.
Because when trust becomes part of ranking and content workflow design, the people who planned for it will win. And this gap in availability will shape who adopts first, and how fast.
The first wave of verifier integration won’t happen in ecommerce or blogging. It’ll happen in banking, insurance, healthcare, government, and legal.
These industries already have review workflows. They already track citations. They already pass content through legal, compliance, and risk before it goes live.
Verifier data is just another field in the checklist. Once a model can provide it, these teams will use it to tighten controls and speed up approvals. They’ll log verification scores. Adjust thresholds. Build content QA dashboards that look more like security ops than marketing tools.
That’s the future. It starts with the teams that are already being held accountable for what they publish.
You can’t install a verifier today. But you can build a practice that’s ready for one.
Start by designing your QA process like a verifier would:
This isn’t about being paranoid. It’s about being ahead of the curve when trust becomes a surfaced metric.
People hear “AI verifier” and assume it means the human reviewer goes away.
It doesn’t. What happens instead is that human reviewers move up the stack.
You’ll stop reviewing line-by-line. Instead, you’ll review the verifier’s flags, manage thresholds, and define acceptable risk. You become the one who decides what the verifier means.
That’s not less important. That’s more strategic.
The verifier layer is coming. The question isn’t whether you’ll use it. It’s whether you’ll be ready when it arrives. Start building that readiness now, because in SEO, being six months ahead of the curve is the difference between competitive advantage and playing catch-up.
Trust, as it turns out, scales differently than content. The teams who treat trust as a design input now will own the next phase of search.
More Resources:
This post was originally published on Duane Forrester Decodes.
Featured Image: Roman Samborskyi/Shutterstock
https://www.searchenginejournal.com/the-verifier-layer-why-seo-automation-still-needs-human-judgment/553586/
For years, marketers built their strategies around a clear and visible funnel: awareness, consideration, conversion.
It worked well in a web where behaviors were traceable, people clicked links, visited pages, signed up, bought a product, or bounced.
We were able to track almost all of it, and we had attribution models that helped show return on investment (ROI) to specific channels (with varying degrees of accuracy and certainty).
The journey hasn’t disappeared, but it’s harder to detect, and it has become a lot more convoluted.
People are still moving through a decision-making process; they’re just doing it across fragmented platforms, using tools that don’t always leave clear signals behind.
Whether it’s asking ChatGPT, browsing Reddit, scrolling through TikTok, or speaking to a voice assistant, user behavior is fluid, multimodal, and largely invisible to traditional analytics.
We can no longer assume that a user’s next step will be a trackable one.
They might ask an AI model for a summary. They might compare products across 10 different surfaces before ever visiting your site.
They might never fill out a form, but forward the website to a colleague, and they’ll fill out the form as a single session, tracked as “Direct,” having never been on your site before.
That doesn’t mean the funnel is gone; it’s just become almost untrackable.
The traditional marketing funnel breaks down the customer journey into three core stages:
Marketers used to map content to each of these stages, creating clear pathways for users to follow from curiosity to conversion.
That model still applies, but how users move between these stages is now anything but linear.
Multimodal search isn’t just about the difference between typing a query, speaking it out loud, or snapping a photo.
It’s about the way users fluidly engage across different platforms and media types to explore, evaluate, and decide.
A single purchase journey might involve:
Even Amazon itself is leaning into AI-led search with Rufus, its generative shopping assistant. This is multimodal search.
Image from author, August 2025Google is layering AI Overviews and AI Mode into its core search experience, offering summarized insights and altering the sequence of discovery.
Users no longer click 10 blue links. They skim summaries, compare sources at a glance, and dive deeper only if curiosity is triggered and a user acts on it.
Multi-modal means multi-platform, multi-surface, and multi-behavior.
It requires us to plan for nonlinear journeys, where influence happens in places we don’t control, and impact happens without attribution.
This shift demands a change in how we create and distribute content:
If we design content around one channel, one format, or one assumed path, we’re missing the majority of how people actually search, explore, and decide.
The challenge now is to understand user intent without seeing every step. To stay present in invisible paths. To meet people in the middle of journeys we can’t fully track.
The funnel still matters. But, reaching people inside it requires a different mindset, one that’s built for anticipation, not just observation and end goal metrics.
For the next generation of internet users, multimodal isn’t just a feature; it’s the foundation.
Gen Z is growing up with tools that let them search the world visually, conversationally, and socially.
They don’t see these modes as alternatives to traditional search; they see them as default behaviors.
Google’s data reflects this shift. Gen Z (18-24 year olds) is currently the fastest-growing demographic using Google Search.
And among that cohort, 1 in 10 searches now begin with a visual interaction, and using tools like Google Lens or Circle to Search.
Image from author, August 2025Instead of typing a query, users highlight parts of an image, scan real-world objects, or interact directly with on-screen content.
This visual-first, intent-rich behavior is a window into how the next generation navigates information. It blends curiosity with immediacy – and it bypasses traditional keyword-driven journeys entirely.
Marketers need to understand this shift not as a niche use case, but as a sign of things to come.
If we’re not building content and experiences that match these native behaviors, we risk being invisible in the very spaces where influence now begins.
Personas and audience segmentation still matter, maybe more than ever, but we can’t speak to people at just one stage or in one format.
Mental availability now has to be a core part of any digital marketing strategy.
It’s not about being everywhere for everyone, but about being present across enough moments and modes that your brand is part of the conversation when decisions are being made.
The old way of choosing a format, identifying a single funnel stage, and publishing content to fit is no longer enough.
We need to create for complexity. That means producing content that reaches both the 1% and the 99% of your target persona, ranging from niche, problem-aware research queries to broad, ambient brand mentions in trending content.
Every digital touchpoint is a chance to build familiarity and relevance.
And in a landscape where visibility is often obscured, casting a wider, more thoughtful net across intent types, platforms, and formats is how you maximize your odds of being chosen, even if you never see the full journey play out.
Content distribution now plays a critical role in both SEO and broader brand strategy.
We want our messaging to be present wherever users are searching, reading, watching, or asking questions. That means treating our website as one, but not the only, SEO and AI optimization asset.
In my opinion, content and SEO strategies that focus only on the owned domain are limiting their effectiveness.
Search engines and AI models are increasingly drawing context, citations, and understanding from a wide range of sources across the open web.
If your brand only shows up on your own site, you reduce your discoverability, authority, and influence.
To compete in the AI-shaped web, marketers need to distribute content intentionally across partner sites, third-party platforms, social channels, structured formats, and multimedia content ecosystems.
Visibility is earned across surfaces, not confined to a single domain.
More Resources:
Featured Image: DETHAL/Shutterstock
https://www.searchenginejournal.com/multimodal-search-is-reshaping-the-funnel-for-seos-and-marketers/553294/
While industry professionals have debates over nomenclature of SEO, GEO, or AEO, and if ChatGPT or Google’s AI Overviews will replace traditional search, a more fundamental shift is happening that could disrupt the entire industry business model.
To get a better understanding of this, I spoke to the 25-year veteran and SEO pioneer Duane Forrester to discuss some of his recent articles about the shift from traditional SEO and the impact on how SEO roles are changing and adapting.
Duane previously worked at Microsoft as a senior program manager of SEO, where he helped to launch Bing Webmaster Tools and bring Schema.org to life. He has a deep understanding of how search engines work and has now turned his attention to adapting to the realities of AI-powered search and digital discovery.
His belief is that the real disruption isn’t AI replacing search engines; it’s the rise of AI agents. These “Agentic AI” systems will empower individuals to work like small agencies, and the jobs that thrive will be those that can effectively manage an AI team.
In Duane’s recent article “SEO’s Existential Threat is AI, but Not in the Way You Think,” he said it’s the rise of AI agents and retrieval-based systems that are already transforming how people interact with information, quietly eroding SEO’s return on investment. So, I asked him how agents and not SERPs are the future.
Duane explained:
“The most significant development isn’t AI replacing search engines; it’s the emergence of Agentic AI systems that can be given tasks and execute them autonomously … This is really a personal thing and I’ve been following this since I worked at Microsoft. I did some early work with Cortana with that program and training it for language recognition.”
Within six months, Duane predicts professionals will routinely instruct AI agents to perform work while they focus on higher-value activities. This is going to have the impact where individuals can behave much more like a small agency.
“If I can create a process and the process is largely executed by agents, then the 100% of my time that I can devote can be reapportioned to human-in-the-loop analysis.
This is going to be the way for us to create virtual players on our team and to do specific tasks to enable us to define the most valuable use of our time, whatever it happens to be. That valuable use of time for some people may be closing their next client. It may simply be the sales cycle. For other people who, maybe, lack knowledge and experience, it may actually be executing on what you promised the client.”
However, Dunae thinks that developing people management skills will be critical to success:
“If you step into the world of Agentic AI and you’re going down that path, you better have people management skills because you’re going to need them. That’s the skill set that will prove most valuable to managing Agentic AI work. You have to think of them not necessarily as humans, but as systems that need guidance.”
I then asked Duane about his latest article, where he wrote about which SEO jobs AI will reshape and which might disappear.
He responded that the most dramatic changes will impact content creators, but not in the way many expect.
Duanes thinks that traditional writing roles face automation, but professionals who adapt will become more valuable than ever.
“If your full-time job is sitting down writing, that’s in jeopardy,” Duane acknowledges.
“The new model transforms writers from creators to instructors, managing multiple AI agents across different clients simultaneously. Instead of spending hours researching and writing, professionals can brief a dozen agents in minutes and focus on editing, refining tone, and ensuring accuracy.”
“You can tell a dozen agents for a dozen clients to all start and you can get them all started in less than two minutes and then in about 10 minutes have all of the output that you now will go in and edit one by one.”
Paradoxically, he thinks the role most in demand will be quality experienced writers, but only those who learn how to embrace and integrate AI to be efficient and effectively manage an AI team of writers.
By becoming a “human in the loop” editor who can guide AI output, an experienced writer can add value in ways machines can’t by refining tone, ensuring factual accuracy, and aligning copy with brand voice and client needs.
“I recently wrote about a Microsoft survey that showed the overlay of how AI can do a job versus humans doing that same job … their point was, if you’re in these jobs, you kind of want to figure out how to pivot to something different.”
The jobs that are vulnerable to AI are those with a repetitive nature that can be done by an AI faster, easier, and cheaper than a human.
While these execution-focused roles face disruption, strategic positions like CMOs remain relatively protected. These roles survive because they require experience-based decision-making that AI cannot replicate.
“It’s going to be harder to replace that level of experience because the system doesn’t have the experience,” Duane emphasizes.
The distinction isn’t about seniority but about the nature of the work. Repetitive tasks get automated first, while roles requiring strategic thinking, relationship building, and complex problem-solving remain human-dominated.
CMOs are considered “safe” not because they are senior, but because they are thinking in terms of strategy. They succeed by analyzing consumer behavior, identifying monetization opportunities, and aligning products with customer problems, capabilities that demand human insight and industry knowledge.
“They’re watching consumer behavior, and they’re trying to tease out from the consumer behavior: How do we make money from that? How do we align our product to solve a customer’s problem? And then that generates more sales. That’s the job of the CMO.
And then everything else under it, which is building and maintaining the team, running all the groups, and making sure everything is on track. It’s going to be harder to replace that level of experience because the system doesn’t have the experience.”
Success in these evolving times requires immediate action on hiring and training. Companies must update job descriptions today to reflect skills needed in two to three years, or develop comprehensive training programs for existing staff.
“The people you’re hiring today, in theory, should still be with you in a couple of years. And if they are still with you in a couple of years and you don’t hire these new skills today, well then, you better have a training plan to get them there.”
I compared the current transformation with the early days of SEO, when pioneers navigated uncharted territory. Today’s professionals face a similar challenge of adapting to work alongside AI systems or risking obsolescence.
The future belongs to those who can embrace AI as a productivity multiplier rather than a replacement threat. Those who learn to instruct, guide, and optimize AI agents will find themselves more valuable than ever, while those who resist change may find themselves left behind.
“This isn’t just about surviving disruption,” Duane concluded. “It’s about positioning yourself to benefit from it.”
Watch the full video interview with Duane Forrester below.
[embedded content]
Duane is currently writing about the shift from traditional SEO to vector-driven retrieval and AI-generated answers at Duane Forrester Decodes and featured here at Search Engine Journal.
Thank you to Duane for offering his insights and being my guest on IMHO.
More Resources:
Featured Image: Shelley Walsh/Search Engine Journal
https://www.searchenginejournal.com/ex-microsoft-seo-pioneer-on-why-ais-biggest-threat-to-seo-isnt-what-you-think/553496/
Google’s Gary Illyes answered a question about why Google doesn’t use social sharing as a ranking factor, explaining that it’s about the inability to control certain kinds of external signals.
Kenichi Suzuki (LinkedIn profile), of Faber Company (LinkedIn profile), is a respected Japanese search marketing expert who has at least 25 years of experience in digital marketing. I last saw him speak at a Pubcon session a few years back, where he shared his findings on qualities inherent to sites that Google Discover tended to show.
Suzuki published an interview with Gary Illyes, where he asked a number of questions about SEO, including this one about SEO, social media, and Google ranking factors.
Gary Illyes is an Analyst at Google (LinkedIn profile) who has a history of giving straightforward answers that dispel SEO myths and sometimes startle, like the time recently when he said that links play less of a role in ranking than most SEOs tend to believe. Gary used to be a part of the web publishing community before working at Google, and he was even a member of the WebmasterWorld forums under the nickname Methode. So I think Gary knows what it’s like to be a part of the SEO community and how important good information is, and that’s reflected in the quality of answers he provides.
The question about social media and ranking factors was asked by Rio Ichikawa (LinkedIn profile), also of Faber Company. She asked Gary whether social media views and shares were ranking signals.
Gary’s answer was straightforward and with zero ambiguity. He said no. The interesting part of his answer was the explanation of why Google doesn’t use them and will never use them as a ranking factor.
Ichikawa asked the following question:
“All right then. The next question. So this is about the SEO and social media. Is the number of the views and shares on social media …used as one of the ranking signals for SEO or in general?”
Gary answered:
“For this we have basically a very old, very canned response and something that we learned or it’s based on something that we learned over the years, or particularly one incident around 2014.
The answer is no. And for the future is also likely no.
And that’s because we need to be able to control our own signals. And if we are looking at external signals, so for example, a social network’s signals, that’s not in our control.
So basically if someone on that social network decides to inflate the number, we don’t know if that inflation was legit or not, and we have no way knowing that.”
Related: Google Ranking Systems & Signals
External signals that Google can’t control but can be influenced by an SEO are untrustworthy. Googlers have expressed similar opinions about other things that are easily manipulated and therefore unreliable as ranking signals.
Some SEOs might say, “If that’s true, then what about structured data? Those are under the control of SEOs, but Google uses them.”
Yes, Google uses structured data, but not as a ranking factor; they just make websites eligible for rich results. Additionally, stuffing structured data with content that’s not visible on the web page is a violation of Google’s guidelines and can lead to a manual action.
A recent example is the LLMs.txt protocol proposal, which is essentially dead in the water precisely because it is unreliable, in addition to being superfluous. Google’s John Mueller has said that the LLMs.txt protocol is unreliable because it could easily be misused to show highly optimized content for ranking purposes, and that it is analogous to the keywords meta tag, which was used by SEOs for every keyword they wanted their web pages to rank for.
Mueller said:
“To me, it’s comparable to the keywords meta tag – this is what a site-owner claims their site is about … (Is the site really like that? well, you can check it. At that point, why not just check the site directly?)”
The content within an LLMs.txt and associated files are completely in control of SEOs and web publishers, which makes them unreliable.
Another example is the author byline. Many SEOs promoted author bylines as a way to show “authority” and influence Google’s understanding of Expertise, Experience, Authoritativeness, and Trustworthiness. Some SEOs, predictably, invented fake LinkedIn profiles to link from their fake author bios in the belief that author bylines were a ranking signal. The irony is that the ease of abusing author bylines should have been reason enough for the average SEO to dismiss them as a ranking-related signal.
In my opinion, the key statement in Gary’s answer is this:
“…we need to be able to control our own signals.”
I think that the SEO community, moving forward, really needs to rethink some of the unconfirmed “ranking signals” they believe in, like brand mentions, and just move on to doing things that actually make a difference, like promoting websites and creating experiences that users love.
Watch the question and answer at about the ten minute mark:
[embedded content]
Featured Image by Shutterstock/pathdoc
https://www.searchenginejournal.com/google-explains-why-they-need-to-control-their-ranking-signals/553657/
Google cites a 40% drop in invalid ad traffic from deceptive serving, helping protect budgets and keep billing clean for advertisers.
https://www.searchenginejournal.com/google-invalid-ad-traffic-from-deceptive-serving-down-40/553563/
An advisory was issued about a critical vulnerability in the popular Tutor LMS Pro WordPress plugin. The vulnerability, rated 8.8 on a scale of 1 to 10, allows an authenticated attacker to extract sensitive information from the WordPress database. The vulnerability affects all versions up to and including 3.7.0.
The vulnerability results from improper handling of user-supplied data, enabling attackers to inject SQL code into a database query. The Wordfence advisory explains:
“The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. “
A time-based SQL injection attack is one in which an attacker determines whether a query is valid by measuring how long the database takes to respond. An attacker could use the vulnerable order parameter to insert SQL code that delays the database’s response. By timing these delays, the attacker can deduce information stored in the database.
While exploitation requires authenticated access, a successful exploitation of the flaw could be used to access sensitive information. Updating to the latest version, 3.7.1 or higher is recommended.
Featured Image by Shutterstock/Ollyy
https://www.searchenginejournal.com/critical-vulnerability-affects-tutor-lms-pro-wordpress-plugin/553555/
An advisory was issued for three WordPress file management plugins that are affected by a vulnerability that allows unauthenticated attackers delete arbitrary files. The three plugins are installed in over 1.3 million websites.
The vulnerability is caused by outdated versions of the elFinder file manager, specifically versions 2.1.64 and earlier. These versions contain a Directory Traversal vulnerability that allows attackers to manipulate file paths to reach outside the intended directory. By sending requests with sequences such as example.com/../../../../, an attacker could make the file manager access and delete arbitrary files.
Wordfence named the following three plugins as affected by this vulnerability:
1. File Manager WordPress Plugin
Installations: 1 Million
2. Advanced File Manager – Ultimate WP File Manager And Document Library Solution
Installations: 200,000+
3. File Manager Pro – Filester
Installations: 100,000+
According to the Wordfence advisory, the vulnerability can be exploited without authentication, but only if a site owner has made the file manager publicly accessible, which mitigates the possibility of exploitation. That said, two of the plugins indicated in their changelogs that an attacker needs at least a subscriber level authentication, the lowest level of website credentials.
Once exploited, the flaw allowed deletion of arbitrary files. Users of the named WordPress plugins should consider updating to the latest versions.
Featured Image by Shutterstock/Lili1992
https://www.searchenginejournal.com/vulnerability-in-3-wordpress-file-plugins-affects-1-3-million-sites/553550/
A vulnerability advisory was issued for a WordPress plugin that saves contact form submissions. The flaw enables unauthenticated attackers to delete files, launch a denial of service attack, or perform remote code execution. The vulnerability was given a severity rating of 9.8 on a scale of 1 to 10, indicating the seriousness of the issue.
The Database for Contact Form 7, WPForms, Elementor Forms, also apparently known as the Contact Form Entries Plugin, saves contact form entries into the WordPress database. It enables users to view contact form submissions, search them, mark them as read or unread, export them, and perform other functions. The plugin has over 70,000 installations.
The plugin is vulnerable to PHP Object Injection by an unauthenticated attacker, which means that an attacker does not need to log in to the website to launch the attack.
A PHP object is a data structure in PHP. PHP objects can be turned into a sequence of characters (serialized) in order to store them and then deserialized (turned back into an object). The flaw that gives rise to this vulnerability is that the plugin allows an unauthenticated attacker to inject an untrusted PHP object.
If the WordPress site also has the Contact Form 7 plugin installed, then it can trigger a POP chain during deserialization.
According to the Wordfence advisory:
“This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.”
All versions of the plugin up to and including 1.4.3 are vulnerable. Users are advised to update their plugin to the latest version, which as of this date is version 1.4.5.
Featured Image by Shutterstock/tavizta
https://www.searchenginejournal.com/wordpress-contact-form-entries-plugin-vulnerability-affects-70k-websites/553546/
Google is rolling out a new setting that lets you pick which news outlets you want to see more often in Top Stories.
The feature, called Preferred Sources, is launching today in English in the United States and India, with broader availability in those markets over the next few days.
Preferred Sources lets you choose one or more outlets that should appear more frequently when they have fresh, relevant coverage for your query.
Google will also show a dedicated From your sources section on the results page. You will still see reporting from other publications, so Top Stories remains a mix of outlets.
Google Product Manager Duncan Osborn says the goal is to help you “stay up to date on the latest content from the sites you follow and subscribe to.”
Image Credit: GoogleYou can update your selections at any time. If you previously opted in to the experiment through Labs, your saved sources will carry over.
In early testing through Labs, more than half of participants selected four or more sources. That suggests people value seeing a range of outlets while still leaning toward publications they trust.
For publishers, Preferred Sources creates a direct way to encourage loyal readers to see more of your coverage in Search.
Loyal audiences are more likely to add your site as a preferred source, which can increase the likelihood of showing up for them when you have fresh, relevant reporting.
You can point your audience to the new setting and explain how to add your site to their list. Google has also published help resources for publishers that want to promote the feature to followers and subscribers.
This adds another personalization layer on top of the usual ranking factors. Google says you will still see a diversity of sources, and that outlets only appear more often when they have new, relevant content.
Preferred Sources fits into Google’s push to let you customize Search while keeping a variety of perspectives in Top Stories.
If you have a loyal readership, this feature is another reason to invest in retention and newsletters, and to make it easy for readers to follow your coverage on and off Search.
https://www.searchenginejournal.com/google-rolls-out-preferred-sources-for-top-stories-in-search/553529/