Facebook plugin bug lets hackers hijack WordPress sites’ chat

guest · Aug 5, 2020

Facebook plugin bug lets hackers hijack WordPress sites’ chat
August 4, 2020
https://www.bleepingcomputer.com/ne...bug-lets-hackers-hijack-wordpress-sites-chat/

A high severity bug found in Facebook's official chat plugin for WordPress websites with over 80,000 active installations could allow attackers to intercept messages sent by visitors to the vulnerable sites' owner.

The Facebook Chat Plugin allows WordPress website owners to embed a chat pop-up to communicate with visitors in real-time through Facebook's messaging platform for Facebook Pages.
Man in the middle of your site's chat
In a report published today by Wordfence's Threat Intelligence team, threat analyst Chloe Chamberland says that the high severity authenticated options change vulnerability with a 7.4 CVSS base score rating was discovered on June 26, 2020.
Click to expand...

Over 50,000 sites still exposed to attacks
Even though Facebook Chat Plugin version 1.6, the release that addresses this vulnerability was published on July 28, the plugin was downloaded only 25,657 times since then based on historic download data provided by WordPress' portal, this being the total number of both updates and new installs.

This means that at least 54,000 WordPress sites with active Messenger Chat pop-ups are still left exposed to attacks designed to exploit this flaw as part of future hacking campaigns.
Click to expand...

Wordfence: The Official Facebook Chat Plugin Created Vector for Social Engineering Attacks

On June 26, 2020, our Threat Intelligence team discovered a vulnerability in The Official Facebook Chat Plugin, a WordPress plugin installed on over 80,000 sites. This flaw made it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites.
Click to expand...

Log in or Sign up

Facebook plugin bug lets hackers hijack WordPress sites’ chat

guest Guest

Log in or Sign up

Facebook plugin bug lets hackers hijack WordPress sites’ chat

guest Guest

Useful Searches