Popular AMP Plugin for WordPress Patches Critical Flaw – Update Now

guest · Nov 17, 2018

Popular AMP Plugin for WordPress Patches Critical Flaw – Update Now
November 16, 2018
https://thehackernews.com/2018/11/amp-plugin-for-WordPress.html

A security researcher has disclosed details of a critical vulnerability in one of the popular and widely active plugins for WordPress that could allow a low-privileged attacker to inject malicious code on AMP pages of the targeted website.

The vulnerable WordPress plugin in question is "AMP for WP – Accelerated Mobile Pages" that lets websites automatically generate valid accelerated mobile pages for their blog posts and other web pages.

"AMP for WP" is the most popular among others with more than 100,000 installations.
The affected plugin was recently removed temporarily from the WordPress plugins library due to vulnerable code, but neither its developer nor the WordPress team revealed the exact issue in the plugin.

"The AMP plugin vulnerability is located in the ampforwp_save_steps_data which is called to save settings during the installation wizard. It's been registered as wp_ajax_ampforwp_save_installer ajax hook," Sikic says in a blog post published today.

"This particular plugin vulnerability is a critical issue for websites that allow user registration."
Click to expand...

Log in or Sign up

Popular AMP Plugin for WordPress Patches Critical Flaw – Update Now

guest Guest

Log in or Sign up

Popular AMP Plugin for WordPress Patches Critical Flaw – Update Now

guest Guest

Useful Searches