Thousands of WordPress websites were found using a vulnerability add-on that allows threat actors to take over the site entirely.
Researchers uncovered a critical flaw in YITH WooCommerce Gift Cards Premium, an add-on for the website builder providing an interface to build gift cards on WordPress sites, which is reportedly being used by more than 50,000 websites.
The flaw itself is an unauthenticated arbitrary file upload vulnerability, allowing crooks, among other things, to upload web shells and gain full access to the target website.
Stealing crypto account details
The vulnerability, tracked as CVE-2022-45359 and given has a severity score of 9.8 – critical, has since been patched and users are urged to update their add-on as soon as possible, as there is evidence of the flaw being abused in the wild.
It was first discovered in late November 2022, when researchers found the flaw present in all versions up to 3.19.0. Hence, users are advised to bring the add-on to at least 3.20.0, or 3.21.0 which is now also available for download.
The flaw was discovered by Wordfence, a cybersecurity company analyzing the WordPress ecosystem, and its researchers claim there are threat actors leveraging the flaw out there, already.
While most attacks took place in November, while the flaw was still considered a zero-day, another peak in usage was also observed on December 14, 2022.
Just two IP addresses (103.138.108.15, and 188.66.0.135) accounted for more than 20,000 exploitation attempts against almost 12,000 websites.
While WordPress itself is relatively stable (around 0.5% of all WordPress-related vulnerabilities fall on the web hosting platform itself), its ecosystem is large and as such, provides ample opportunities for exploitation. Paid add-ons, such as this one, are usually frequently updated and developers try to maintain a secure product, while free add-ons can often go for months without patches and can turn into a real nightmare for webmasters.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba