Researchers Find Serious Flaws In WordPress Plugins Used On 400K Sites
An anonymous reader quotes a report from Ars Technica: Serious vulnerabilities have recently come to light in three WordPress plugins that have been installed on a combined 400,000 websites, researchers said. InfiniteWP, WP Time Capsule, and WP Database Reset are all affected. The highest-impact flaw is an authentication bypass vulnerability in the InfiniteWP Client, a plugin installed on more than 300,000 websites. It allows administrators to manage multiple websites from a single server. The flaw lets anyone log in to an administrative account with no credentials at all. From there, attackers can delete contents, add new accounts, and carry out a wide range of other malicious tasks. The critical flaw in WP Time Capsule also leads to an authentication bypass that allows unauthenticated attackers to log in as an administrator. WP Time Capsule, which runs on about 20,000 sites, is designed to make backing up website data easier. By including a string in a POST request, attackers can obtain a list of all administrative accounts and automatically log in to the first one. The bug has been fixed in version 1.21.16. Sites running earlier versions should update right away. Web security firm WebARX has more details. The last vulnerable plugin is WP Database Reset, which is installed on about 80,000 sites. One flaw allows any unauthenticated person to reset any table in the database to its original WordPress state. The bug is caused by reset functions that aren't secured by the standard capability checks or security nonces. Exploits can result in the complete loss of data or a site reset to the default WordPress settings. A second security flaw in WP Database Reset causes a privilege-escalation vulnerability that allows any authenticated user -- even those with minimal system rights -- to gain administrative rights and lock out all other users. All site administrators using this plugin should update to version 3.15, which patches both vulnerabilities. Wordfence has more details about both flaws here.
from Slashdot https://ift.tt/364L9KT
Read more of this story at Slashdot.
from Slashdot https://ift.tt/364L9KT
Related Posts :
Elon Musk Acquires Twitter For $44 Billion- Two Skydiving Pilots Try to Change Planes in Mid-Air
- 'Aphantasia', Absence of Visual Imagination, Shown Detectable Through Pupil Dilation
- Former NSA Computer Scientist: Patching Vulnerabilities Gives False Sense of Security
- China Hopes To Redirect a Nearby Asteroid Within the Next Four Years
0 Response to "Researchers Find Serious Flaws In WordPress Plugins Used On 400K Sites"
Post a Comment