Bugs in Two Related WordPress Plugins Together Risked Over 1 Million Websites

  •  
  •  
  •  
  • 1
  •  
  •  
  •  
    1
    Share

WordPress websites suffered another threat from vulnerable plugins. This time, security bugs in two related WordPress plugins posed a threat to over a million websites. Researchers noticed the active exploitation of the bugs.

Bugs In Two WordPress Plugins

Researchers from Wordfence have caught security bugs in two separate but related WordPress plugins. As observed, exploiting the bugs in both plugins together could lead to a huge cyber attack.

Stating the details in a blog post, the researchers highlighted that a critical severity bug existed in the Elementor Pro plugin. Exploiting the bug allowed remote code execution attacks as any registered user could upload arbitrary files. As explained by the researchers,

An attacker able to remotely execute code on your site can install a backdoor or webshell to maintain access, gain full administrative access to WordPress, or even delete your site entirely.

It was a zero-day vulnerability as it caught the attention of hackers before the developers.

While the hackers could exploit this bug directly on sites “with open user registration”, they also had an option to exploit this bug even for websites with this option disabled.

In the latter case, they could exploit a registration bypass vulnerability in another plugin Ultimate Addons for Elementor.

Patches Rolled Out

Wordfence has confirmed the active exploitation of the bugs. They even checked some compromised websites to confirm the threat. As stated in their post,

As this is an active attack, we wanted to alert you so that you can take steps to protect your site. We are intentionally limiting the amount of information this post provides, because this is an ongoing attack.

Although, the developers behind both plugins have patched the flaws. Hence, the users should ensure updating their websites to Elementor Pro version 2.9.4, and Ultimate Addons for Elementor version 1.24.2 or higher.

Moreover, the researchers have also recommended the following to make sure that the website remains uncompromised.

-Check for any unknown subscriber-level users on your site.
– Check for files named “wp-xmlrpc.php.”
– Delete any unknown files or folders found in /wp-content/uploads/elementor/custom-icons/ directory.

Let us know your thoughts in the comments.

The following two tabs change content below.

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Do NOT follow this link or you will be banned from the site!