Vulnerabilities in Two Major WordPress Plugins Impact Over 7 Million Sites

On March 18, 2021, researchers revealed security flaws in several WordPress plugins, which, if exploited, could enable attackers to execute arbitrary code and potentially take control of affected websites. The vulnerabilities were found in Elementor, a widely-used website builder plugin installed on more than seven million sites, and WP Super Cache, a popular tool for serving cached pages on WordPress. According to Wordfence, which identified the weaknesses in Elementor, the issue involves a series of stored cross-site scripting (XSS) vulnerabilities (CVSS score: 6.4). This occurs when malicious scripts are injected directly into a vulnerable web application. Specifically, the lack of server-side validation for HTML tags allows an attacker to inject executable JavaScript into posts or pages through crafted requests. “Since posts created by contributors are usually reviewed by editors or administrators before publication, any JavaScript added to one of the…

Vulnerabilities in Two Major WordPress Plugins Expose Over 7 Million Sites

Researchers have revealed critical vulnerabilities in several WordPress plugins that pose high security risks, potentially enabling attackers to execute arbitrary code and seize control of affected websites. The identified flaws are present in Elementor, a widely used website builder plugin that supports over seven million websites, as well as WP Super Cache, a plugin designed to optimize site performance by serving cached pages.

According to findings from Wordfence, the security issues within Elementor are primarily due to a series of stored cross-site scripting (XSS) vulnerabilities, carrying a Common Vulnerability Scoring System (CVSS) score of 6.4. These vulnerabilities arise when harmful scripts are injected into a web application that lacks proper validation of HTML tags server-side. This situation allows malicious actors to introduce executable JavaScript into posts or pages through crafted requests.

The potential implications of these vulnerabilities are significant, especially considering the common practice of requiring that posts generated by contributors undergo an editorial review before publication. Given this workflow, any JavaScript introduced into a post could go unnoticed, thereby increasing the risk of exploitation.

The two plugins have become integral to many businesses operating online, and their compromise could lead to severe repercussions. If attackers successfully leverage these vulnerabilities, they could manipulate website content or redirect users to malicious sites, undermining both user trust and business integrity.

In assessing the methods that could be employed in exploiting these weaknesses, one can reference the MITRE ATT&CK framework. Techniques such as initial access through XSS, persistence by modifying web content, and potential privilege escalation can all be considered in the context of this incident. The dynamics of such an attack reveal how foundational security practices need to evolve continuously to combat increasingly sophisticated cyber threats.

Business owners utilizing these plugins are urged to stay vigilant and implement timely updates to mitigate risks associated with these vulnerabilities. The lack of proactive security measures can quickly lead to severe consequences, including extensive data breaches and potential monetary losses.

As the digital landscape grows, so too must our defenses. Awareness and timely action are critical in safeguarding not just websites but also the sensitive data they may house. Understanding the underlying vulnerabilities and employing sound security practices will be essential for any organization aiming to maintain resilience against cyber threats in an increasingly perilous online environment.

Source link

Related Posts

Urgent: High-Severity RCE Vulnerability Discovered in Apache OFBiz ERP Software – Immediate Patch Required

On March 22, 2021, the Apache Software Foundation disclosed a critical vulnerability in Apache OFBiz that poses a significant risk. Tracked as CVE-2021-26295, this flaw allows unauthenticated attackers to potentially take remote control of the open-source enterprise resource planning (ERP) system. It impacts all versions prior to 17.12.06 and involves an “unsafe deserialization” vulnerability that enables remote code execution on susceptible servers.

Apache OFBiz is a Java-based web framework designed for automating various enterprise processes, including accounting, customer relationship management, manufacturing, order management, supply chain fulfillment, and warehouse management. By exploiting this vulnerability, an attacker can manipulate serialized data to introduce arbitrary code. Once deserialized, this code can lead to unauthorized remote execution. It is crucial for users to implement the necessary patches immediately.

Critical Security Flaws Discovered in Netop Remote Learning Software

On March 22, 2021, cybersecurity researchers revealed significant vulnerabilities in the remote student monitoring tool, Netop Vision Pro. These weaknesses could potentially allow attackers to execute arbitrary code and gain control over Windows computers. The McAfee Labs Advanced Threat Research team warned that these vulnerabilities enable privilege escalation and could facilitate full access to students’ devices within the same network. The identified issues, labeled as CVE-2021-27192, CVE-2021-27193, CVE-2021-27194, and CVE-2021-27195, were reported to Netop on December 11, 2020. The Denmark-based company addressed these vulnerabilities in an update (version 9.7.2) released on February 25. According to Netop, this maintenance release resolved several security concerns, including local privilege escalation and transmitting sensitive data in plain text.

Critical Remote Code Execution Vulnerability Found in SolarWinds Orion Platform

On March 26, 2021, SolarWinds, a provider of IT infrastructure management solutions, announced a new update for its Orion network monitoring tool, addressing four security vulnerabilities. Among these, two critical flaws could be exploited by an authenticated attacker for remote code execution (RCE).

The most concerning issue involves a JSON deserialization vulnerability, allowing authenticated users to run arbitrary code through the “test alert actions” feature in the Orion Web Console, which simulates network events like unresponsive servers to trigger alerts during setup. This flaw has been classified as critical in severity.

The second vulnerability poses a high risk as it enables an attacker to execute RCE in the Orion Job Scheduler, although the attacker must first possess the credentials of an unprivileged local account on the Orion Server to exploit it. SolarWinds provided limited technical details in its advisory.

OpenSSL Issues Updates to Address Two Critical Security Vulnerabilities

On March 26, 2021, OpenSSL maintainers released fixes for two high-severity security flaws that could lead to denial-of-service (DoS) attacks and the circumvention of certificate verification. Identified as CVE-2021-3449 and CVE-2021-3450, these vulnerabilities have been patched in the latest update (version OpenSSL 1.1.1k), made available on Thursday. CVE-2021-3449 is applicable to all OpenSSL 1.1.1 versions, while CVE-2021-3450 affects versions 1.1.1h and later. OpenSSL provides cryptographic functions that support the Transport Layer Security protocol, aiding in the secure transmission of communication over networks. According to an advisory from OpenSSL, CVE-2021-3449 poses a potential DoS risk linked to NULL pointer dereferencing, which can result in an OpenSSL TLS server crash if a client sends a malicious “ClientHello” message during the handshake process.