WordPress Cookie Consent Plugin Fixes Critical Flaw for 700K Users

guest · Feb 12, 2020

WordPress Cookie Consent Plugin Fixes Critical Flaw for 700K Users
February 12, 2020
https://www.bleepingcomputer.com/ne...nt-plugin-fixes-critical-flaw-for-700k-users/

Critical bugs found in the WordPress GDPR Cookie Consent plugin used by over 700,000 websites allow potential attackers to delete and change content and inject malicious JavaScript code due to improper access controls.

The GDPR Cookie Consent plugin is designed to allow site admins to display customizable header or footer cookie banners to show their website's EU Cookie Law (GDPR) compliance.
The plugin maintained by WebToffee is also among the top 100 most popular ones in the WordPress plugins repository and is used by more than 700,000 sites according to the active installations count on its WordPress library entry.
WordPress stored cross-site scripting and privilege escalation
The vulnerability rated as critical doesn't yet have a CVE ID and it affects version 1.8.2 and earlier. WebToffee patched it with the release of version 1.8.3 on February 10, six days after it was reported to the plugin's developer by NinTechNet security researcher Jerome Bruandet.
Click to expand...

"An authenticated user such as a subscriber can use it to put any existing page or post (or the entire website) offline by changing their status from 'published' to 'draft'," Bruandet explains.
"Additionally, it is possible to delete or change their content. Injected content can include formatted text, local or remote images as well as hyperlinks and shortcodes."
During the last two days since the patched version was released, a little over 76,000 users have already updated their installations, with more than 600,000 still having to secure their websites from potential attacks in installing the latest release.
Click to expand...

Wordfence: Improper Access Controls in GDPR Cookie Consent Plugin

CVSS Score: 9.0 (Critical)

In today’s post, we detailed how a missing capabilities check can lead to stored cross-site scripting in the GDPR Cookie Consent plugin. This vulnerability has been fixed in version 1.8.3. We recommend that users immediately update to the latest version available
Click to expand...

142395 · Feb 13, 2020

This is why you should block those unnecessary WP plugins. My list, now partly shared on Github, has included the said plugin much earlier than this news tho both Fanboy and AdGuard Annoyances lists seem not to include it.

Log in or Sign up

WordPress Cookie Consent Plugin Fixes Critical Flaw for 700K Users

guest Guest

142395 Guest

Log in or Sign up

WordPress Cookie Consent Plugin Fixes Critical Flaw for 700K Users

guest Guest

142395 Guest

Useful Searches