| Version 6.2 | 28% |
|---|---|
| Version 6.1 | 14.7% |
| Version 6.0 | 7.3% |
| Version 5.9 | 11.1% |
| Other Versions | 39% |
Accurate as of 7/22/2023
WordPress, one of the most popular website platforms, offers a wide range of plugins to enhance website functionality. One such plugin is WooCommerce Payments, enabling users to accept credit and debit card payments in their WooCommerce stores. However, this widely-used plugin recently fell prey to a severe website security vulnerability, which hackers are actively exploiting to gain unauthorized privileges on vulnerable WordPress installations, including administrator access. In this blog post, we will delve into the details of the vulnerability, the scope of the attacks, and most importantly, how you can protect your WordPress site from falling victim to this cyber threat.
The Critical WooCommerce Payments Vulnerability:
On March 23rd, 2023, developers released version 5.6.2 of the WooCommerce Payments plugin to address a critical vulnerability rated 9.8, known as CVE-2023-28121. The flaw impacted versions 4.8.0 and higher of the plugin, with the fix implemented in versions 4.8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2, and later.
Exploitation of the Vulnerability:
The vulnerability allowed remote attackers to impersonate administrators and gain complete control over vulnerable WordPress sites. To exploit the flaw, attackers added an ‘X-WCPAY-PLATFORM-CHECKOUT-USER’ request header, specifying the user ID of the account they wished to impersonate. WooCommerce Payments, upon receiving this header, would treat the request as if it originated from the specified user, granting the attacker full privileges associated with that account.
Scale of the Attacks:
Initially, there were no known active exploitations of the vulnerability, but security researchers warned that such attacks were likely due to the severity of the flaw. Their predictions turned out to be accurate when researchers at RCE Security recently analyzed the bug and published a technical blog explaining the vulnerability and its exploitation.
According to WordPress security firm Wordfence, threat actors have launched a massive campaign targeting over 157,000 sites, with attacks starting on Thursday, July 14, 2023. The attacks peaked on Saturday, July 16, 2023, with a staggering 1.3 million attacks against vulnerable sites. The hackers are using the exploit to either install the WP Console plugin or create administrator accounts on the targeted websites.
How to Increase the Website Security of Your WordPress Site:
Given the widespread exploitation of the vulnerability, it is crucial for all websites utilizing the WooCommerce Payments plugin to ensure their installations are up-to-date. If you haven’t already, immediately update to versions 4.8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2, or later. to safeguard your site from this critical flaw.
Additionally, site administrators should conduct thorough scans for any unusual PHP files and suspicious administrator accounts that may have been created by attackers. Delete any unauthorized files or accounts to eliminate potential backdoors that could grant hackers access even after the vulnerability has been patched.
Conclusion:
The recent exploitation of the critical WooCommerce Payments plugin vulnerability highlights the importance of website security and maintaining up-to-date software and diligently monitoring your WordPress site for any signs of suspicious activity. By taking proactive measures and staying informed about potential security threats, website owners can effectively protect their online assets and ensure a safe and secure online presence. Remember, a well-defended website is the key to a successful online venture!
Check out more posts from Lawrence Abrams.
| Version 5.2 | 31.6% |
|---|---|
| Version 5.1 | 34.6% |
| Version 4.4 | 23.9% |
| Version 4.3 | 5.1% |
| Other Versions | 4.8% |
Accurate as of 7/22/2023
The security of WordPress websites is paramount, with numerous plugins designed to safeguard against potential threats. However, recent reports have unveiled a critical flaw in the All-In-One Security (AIOS) WordPress security plugin, used by over a million websites. This website security vulnerability exposed user login attempts and, alarmingly, plaintext passwords to the site’s database, putting countless accounts at risk. In this blog post, we’ll delve into the details of the issue, explore the potential consequences, and provide actionable steps to protect your WordPress site.
The AIOS Plugin and Its Security Promise:
Developed by Updraft, the AIOS plugin boasts an all-in-one security solution, offering features like web application firewall, content protection, and login security tools. With the promise of thwarting bots and preventing brute force attacks, the plugin gained popularity among WordPress users worldwide.
The Disconcerting Discovery:
Approximately three weeks ago, a user raised an alarming concern about AIOS v5.1.9, reporting that the plugin was logging plaintext passwords from user login attempts into the aiowps_audit_log database table. Although the table was intended to track logins, logouts, and failed login events, the plugin was inadvertently recording sensitive login credentials.
Risk of Non-compliance and Malicious Exploitation:
This revelation raised significant security compliance concerns, potentially violating standards like NIST 800-63, ISO 27000, and GDPR. Furthermore, the stored plaintext passwords posed an elevated risk for both malicious site administrators and hackers. If rogue admins attempted those passwords on other platforms where users used the same credentials, accounts could be easily compromised, especially if not protected by two-factor authentication.
How to fix this website security vulnerability:
In response to the growing urgency of the issue, Updraft released version 5.2.0 on July 11, containing a fix to prevent the storage of plaintext passwords. The update also cleared out old entries containing sensitive information. Users were strongly urged to apply the update immediately to secure their websites from potential breaches.
Widespread Vulnerability and Lack of Timely Response:
As of July 22nd, only about one-third of AIOS users have updated to the latest version, leaving more than 750,000 sites vulnerable to attacks. With WordPress being a common target for threat actors, the delay in Updraft’s response allowed hackers ample time to exploit the plugin’s security flaw. To make matters worse, during the exposure period, Updraft failed to warn its users about the elevated risks, leaving site owners unaware of the potential dangers.
Conclusion:
The recent discovery of a serious vulnerability in the AIOS WordPress security plugin serves as a stark reminder of the constant vigilance required to protect our websites and users. By promptly applying updates and adopting best security practices, we can fortify our WordPress sites and maintain a safer online environment for everyone. Remember, a proactive approach to security is the key to a resilient and well-protected website.
Check out more posts from Bill Toulas.
| Version 2.6 | 67% |
|---|---|
| Version 2.5 | 5.7% |
| Version 2.3 | 5.4% |
| Version 2.1 | 10.7% |
| Other Versions | 11.2% |
Accurate as of 7/22/2023
WordPress, a widely used platform for building websites, relies heavily on plugins to enhance functionality and user experience. However, recent developments have uncovered a dangerous exploit in the ‘Ultimate Member’ WordPress plugin, a popular tool for user profiles and community building. Hackers are taking advantage of a zero-day privilege escalation vulnerability to bypass security measures and gain unauthorized administrator access to websites. In this blog post, we’ll delve into the details of the flaw, explore the potential consequences, and provide crucial steps to protect your WordPress site from this serious threat. Reach out to 12 Virtues Consulting if you want a partner to help you increase the security visibility of the website and overall improve your website security.
The ‘Ultimate Member’ Plugin and its Vulnerability:
‘Ultimate Member’ is a widely-used user profile and membership plugin, empowering WordPress site owners to manage sign-ups and foster communities. Presently, it boasts over 200,000 active installations, making it an attractive target for malicious actors.
The Critical CVE-2023-3460 Vulnerability:
Tracked as CVE-2023-3460 and categorized as “critical” with a CVSS v3.1 score of 9.8, the exploit impacts all versions of the ‘Ultimate Member’ plugin, including the latest v2.6.6. Despite efforts by developers to address the flaw in versions 2.6.3, 2.6.4, 2.6.5, and 2.6.6, residual vulnerabilities remain. The development team is actively working on resolving the issue and aims to release a new update soon.
Exploitation of the Zero-Day Vulnerability:
Website security specialists at Wordfence discovered the attacks exploiting the zero-day flaw. Threat actors manipulate the plugin’s registration forms to set arbitrary user meta values on their accounts. By altering the “wp_capabilities” user meta value, attackers designate themselves as administrators, granting unrestricted access to the compromised site.
Indicators of Compromised WordPress Sites:
Websites hacked using CVE-2023-3460 exhibit several key indicators:
- Appearance of new administrator accounts with usernames like
wpenginer, wpadmins, wpengine_backup, se_brutal, and segs_brutal. - Log records showing access from known malicious IPs to the Ultimate Member registration page.
- Presence of user accounts with email addresses linked to “exelica.com.”
- Installation of unauthorized WordPress plugins and themes on the site.
Immediate Action Required:
Due to the severity of the vulnerability and its easy exploitation, Wordfence strongly recommends uninstalling the ‘Ultimate Member’ plugin immediately. Even the firewall rule developed to protect clients from this threat may not cover all scenarios, necessitating the removal of the plugin until the vendor addresses the issue.
If your site has been compromised, merely removing the plugin is insufficient. Comprehensive malware scans must be performed to eradicate any traces of the attack, such as rogue admin accounts and potential backdoors. For personalized assistance, reach out to local experts.
Conclusion:
The recent zero-day exploit in the ‘Ultimate Member’ WordPress plugin serves as a stark reminder of the criticality of maintaining website security. By taking swift and decisive action, WordPress site owners can safeguard their valuable data and protect their users from potential harm. As the development team works to release a comprehensive fix, vigilance and proactive measures are essential to ensure a safe online environment for all. Remember, in the face of security threats, timely action can make all the difference.
Check out more posts from Bill Toulas.