Critical Bug in WordPress Plugin Lets Hackers Execute Code

guest · Jul 15, 2019

Critical Bug in WordPress Plugin Lets Hackers Execute Code
July 15, 2019
https://www.bleepingcomputer.com/ne...n-wordpress-plugin-lets-hackers-execute-code/

A critical security issue found in the Ad Inserter WordPress plugin currently installed on over 200,000 websites allows authenticated attackers to remotely execute PHP code.
Misuse of CSRF protection function
The vulnerability stems from the use of the check_admin_referer() for authorization, when it was specifically designed to protect WordPress sites against cross-site request forgery (CSRF) exploits using nonces — one-time tokens used for blocking expired and repeated requests.

This practice is discouraged by the WordPress official documentation website which says that "Nonces should never be relied on for authentication or authorization, access control."

"The weakness allowed authenticated users (Subscribers and above) to execute arbitrary PHP code on websites using the plugin," according to the Wordfence researchers who discovered the Ad Inserter plugin critical bug.
Click to expand...

guest · Feb 19, 2020

Zero-Day in WordPress Plugin Exploited to Create Admin Accounts
February 19, 2020
https://www.bleepingcomputer.com/ne...ss-plugin-exploited-to-create-admin-accounts/

A zero-day vulnerability in the ThemeREX Addons, a WordPress plugin installed on thousands of sites, is actively exploited by attackers to create user accounts with admin permissions and potentially fully taking over the vulnerable website.

Based on the estimations of WordPress site security firm Wordfence, the company that reported the ongoing attacks targeting the ThemeREX Addons zero-day bug, the plugin is currently installed on at least 44,000 websites.

"Over 30,000 customers use our Premium WordPress themes to power their websites including some of the world's top brands and businesses," the company says on its website.
Remote code execution and admin account creation
"This flaw allows attackers to remotely execute code on a site with the plugin installed, including the ability to execute code that can inject administrative user accounts," Wordfence threat analyst Chloe Chamberland explains.
The ThemeREX Addons plugin vulnerability has not yet been patched by the developer and no news of this zero-day could be found on the company's support site.
Click to expand...

Wordfence: Zero-Day Vulnerability in ThemeREX Addons Plugin Exploited in the Wild

Today, February 18th, our Threat Intelligence team was notified of a vulnerability present in ThemeREX Addons, a WordPress plugin installed on an estimated 44,000 sites. This flaw allows attackers to remotely execute code on a site with the plugin installed, including the ability to execute code that can inject administrative user accounts.
Click to expand...

guest · Mar 10, 2020

Zero-Day Vulnerability in ThemeREX Addons Now Patched
March 10, 2020
https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

On February 18th, we were alerted to a vulnerability present in ThemeREX Addons, a WordPress plugin installed on approximately 44,000 sites. We took immediate action to release a firewall rule to protect Wordfence Premium users. As this vulnerability was being actively attacked, we also publicly notified the community of the vulnerability to help protect users from being compromised.

As an update to that notification, we’re happy to share that ThemeREX has released updates for all of their themes that included the vulnerable ThemeREX Addons plugin. In today’s post we provide the technical details of the vulnerability along with the steps you need to take to ensure your site is running an updated version of the plugin.
Insight on Attacks
We have blocked over 267,000 exploit attempts during the past 2 weeks since we were initially alerted to the vulnerability’s presence.
We ensured our disclosure on February 18th included minimal details to prevent attackers from exploiting this vulnerability while still alerting users to a critical issue requiring their immediate attention.
Click to expand...

Log in or Sign up

Critical Bug in WordPress Plugin Lets Hackers Execute Code

guest Guest

guest Guest

guest Guest

Log in or Sign up

Critical Bug in WordPress Plugin Lets Hackers Execute Code

guest Guest

guest Guest

guest Guest

Useful Searches