Connect with us
ANE Scholarship
Categories:
X

Technology

WordPress plugin security audit unearths dozens of vulnerabilities impacting 60,000 websites

Published

on

WordPress plugin security audit unearths dozens of vulnerabilities impacting 60,000 websites
Share this post:

Unauthenticated SQL injection bugs put thousands of WordPress sites under threat.

A researcher at security firm Cyllective has unearthed vulnerabilities in dozens of WordPress plugins, affecting tens of thousands of installations.

Dave Miller, who leads Cyllective’s penetration testing team, says they started out testing randomly selected plugins, quickly finding an unauthenticated SQL injection vulnerability.

They also found a series of local file inclusion and remote code execution (RCE) vulnerabilities. However, as these issues were found in severely outdated plugins, the team decided to concentrate its efforts on those that have received updates in the last two years – around 5,000 plugins in total.

Exposed endpoints

Looking particularly for unauthenticated SQL injection vulnerabilities, the researcher used a system of tags to identify plugins showing interaction with the WordPress database; string interpolation in SQL-like strings; security measures relating to sanitization attempts; and exposure of unauthenticated endpoints.

And after three months’ research, says Miller, the result was a total of 35 vulnerabilities, all of which could have been exploited by unauthenticated attackers, affecting around 60,500 instances running the affected WordPress plugins.

“Although the vast majority of the vulnerabilities I reported were unauthenticated SQL injection vulnerabilities, which would have enabled an attacker to dump the entire WordPress database contents, these were not the most devastating ones,” Miller tells The Daily Swig.

“The sitemap-by-click5 plugin suffered from an unauthenticated arbitrary options update flaw, which would have allowed an attacker to maliciously enable the registration functionality and set the default user role to that of an administrator.”

This, he says, would essentially allow an unauthenticated attacker to create a new administrator account and take over the WordPress instance. And, from there, the attacker would be able to upload malicious PHP files, which would grant the attacker remote code execution capabilities on the underlying server as a low-privileged user.

Looking for patterns

With a bit more engineering, says Miller, the team’s tag strategy could be used to fine flaws other than SQL injection vulnerabilities.

“New patterns would need to be developed which capture the specifics of the vulnerability class to be able to detect them,” he says. “Some vulnerability classes are, however, hard or even impossible to detect with this approach.”

Miller says that, despite the large number of vulnerabilities discovered, the disclosure process went smoothly, with the team reporting each vulnerability as it was discovered – on occasion, as many as four or five per day.

“WPScan [a WordPress security vendor] coordinated the process of communication between all the parties involved – researcher, plugin author and the WordPress plugin team – in a timely manner,” he says.

And, he adds, the team is still working through more plugins, with more vulnerabilities being discovered and responsibly disclosed.

“Security is ultimately the responsibility of the plugin developer, and the Plugin team encourages this to the best of its ability,” a WordPress spokesperson tells Daily Swig.

“To this end, guidelines exist for plugin authors to consult before submitting plugins to the directory. All developers are expected to abide by these guidelines. In addition, they have at their disposal a Plugin Handbook that covers security best practices.”


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

Erik Ten Hag Manchester United vs Brighton
Sports15 mins ago

Erik Ten Hag Chops First Breakfast as Man Utd Manager as Brighton Wins 2-1

Ronaldo
Sports2 hours ago

Man Utd must let Ronaldo leave – Wayne Rooney

Scholarship Graduate
Education2 hours ago

Australia Scholarship: Apply for Griffith University degree scholarship, 2022

Godwin Obaseki
Education2 hours ago

Edo Govt To Recruit 1000 New Teachers, Train 650 Others

Airport
News2 hours ago

Ebonyi Govt Laments Destruction Of Airport Fence

Isco
Sports2 hours ago

Transfer: Real Madrid star, Isco to Sevilla as free agent

Neto
Sports2 hours ago

Transfer: Neto joins Bournemouth from Barcelona

Kano loses one pilgrim in Saudi Arabia
News4 hours ago

Kano loses one pilgrim in Saudi Arabia

Tobi Amusan wins a gold medal at the Commonwealth Games and breaks a record
Sports4 hours ago

Tobi Amusan wins a gold medal at the Commonwealth Games and breaks a record

News5 hours ago

Deposed Emir Sanusi: “I’ll keep speaking out to rebuild Nigeria.”

Religious organizations disagree on how to pay for the Jos Main Market project
News5 hours ago

Religious organizations disagree on how to pay for the Jos Main Market project

Jenkins security: The most recent plugin advisory contains flaws with unpatched XSS and CSRF
Technology5 hours ago

Jenkins security: The most recent plugin advisory contains flaws with unpatched XSS and CSRF

ParseThru: Multiple Go apps have been found to have an HTTP parameter smuggling issue
Technology5 hours ago

ParseThru: Multiple Go apps have been found to have an HTTP parameter smuggling issue

Director of Batgirl reveals After the movie was canceled, Marvel CEO Kevin Feige contacted him
Entertainment5 hours ago

Director of Batgirl reveals After the movie was canceled, Marvel CEO Kevin Feige contacted him

Our pop queen dreams have come true with the epic Break My Soul and Vogue remix by Beyonce and Madonna
Entertainment5 hours ago

Our pop queen dreams have come true with the epic Break My Soul and Vogue remix by Beyonce and Madonna

Buhari
News6 hours ago

Buhari condemns killings of Nigeriens and police officials in South East

News6 hours ago

In Ekiti, gunmen abduct a 4-year-old boy while the father runs

News6 hours ago

NDA changes the curriculum to better train cadets for asymmetrical warfare

In Everton's tight loss to Chelsea, Alex Iwobi shines for the team
Sports6 hours ago

In Everton’s tight loss to Chelsea, Alex Iwobi shines for the team

Following a 4-1 loss to Tottenham, Aribo's manager scolds his team as "not good enough."
Sports6 hours ago

Following a 4-1 loss to Tottenham, Aribo’s manager lashes out “not good enough.”

Mohammed Usman, Kamaru Usman's younger brother crowned UFC TUF Champion [Images/Video]
Sports7 hours ago

Mohammed Usman, Kamaru Usman’s younger brother crowned UFC TUF Champion [Images/Video]

Beauty BBNaija
Entertainment7 hours ago

BBNaija S7: Beauty says, “He’s fingered me and sucked my breast,” as she drags Groovy

BBNaija S7: Denrele claims that bbnaija candidates send him n*des and millions of naira in order to take part in the show
Entertainment7 hours ago

BBNaija S7: Denrele claims that bbnaija candidates send him n*des and millions of naira in order to take part in the show

Pep Guardiola
Sports7 hours ago

I’m not at Man City to win UEFA Champions League – Pep Guardiola

Festus Keyamo
News7 hours ago

Buhari Has Delivered, Security Only Exists In Heaven – Festus Keyamo

Dapo Abiodun
News7 hours ago

2023: Ogun State Is Nobody’s Inheritance – Dapo Abiodun

Your weekly tarot horoscope for July 24 to July 30 – and Jupiter going retrograde
Horoscope7 hours ago

Your weekly tarot horoscope for August 7 to August 13 and Venus’s move into Leo

Toolz - Tolu Oniru-Demuren
Entertainment7 hours ago

“Until A Man Is Financially Stable, He’s Not Truly Happy” – Toolz

Ishaq Oloyede
Education7 hours ago

Hard Decisions Needed To End ASUU Strike – JAMB boss

Dino Melaye
News8 hours ago

Bola Tinubu Sees Presidency As Retirement Benefits – Dino Melaye

Your daily horoscope for Monday, July 25, 2022
Horoscope8 hours ago

Your daily horoscope for Sunday, August 7, 2022

Vinicius Jr Wants Five or More UCL at Real Madrid
Sports9 hours ago

Vinicius Jr Wants Five or More UCL at Real Madrid

Diego Simeone
Sports9 hours ago

Why Juventus, Atletico Madrid Game Got Cancelled

Peruzzi
Entertainment9 hours ago

Peruzzi Bags 7-days Ultimatum To Refund ₦3 Million Over Breach of Contract

Thomas Tuchel
Sports9 hours ago

EPL: Thomas Tuchel revels Marcos Alonso’s decision

Messi and Neymar PSG vs Clermont Foot
Sports9 hours ago

Messi Scores Brace as PSG Effortlessly Thrashed Clermont Foot

Buhari
News9 hours ago

Buhari Vows To Track Down Killers Of Imo Police Officers

SADE'S HEART TALE
ANE Stories9 hours ago

[STORY] SADE’S HEART TALE (Episode 20)

Computer Video Game
Technology1 day ago

5 Reasons To Start Playing Computer Games

XSS in Gmail’s AMP For Email earns researcher $5,000
Technology1 day ago

XSS in Gmail’s AMP For Email earns researcher $5,000

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Complete Episodes)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Complete Episodes)

SADE'S HEART TALE
ANE Stories5 days ago

[STORY] SADE’S HEART TALE (Episode 19)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 01)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Complete Episodes)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 07)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 01)

Nwankwo Kanu, a Super Eagles icon, turns 46 [Photos]
Sports6 days ago

Nwankwo Kanu, a Super Eagles icon, turns 46 [Photos]

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 09)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 01)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 03)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 05)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 02)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 04)

Watch the latest "Passport" movie teaser with Mercy Johnson, Zubby Michael, and Jim Iyke
Entertainment6 days ago

Watch the latest “Passport” movie teaser with Mercy Johnson, Zubby Michael, and Jim Iyke

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Final Episode 04)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 06)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 03)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 02)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 05)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 04)

A sizable piece of Elon Musk's space junk has fallen onto an Australian man's farm.
Technology6 days ago

A sizable piece of Elon Musk’s space junk has fallen onto an Australian man’s farm.

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 03)

Celebrity6 days ago

Hilda Dokubo comments on the ransom demanded for colleagues who have been kidnapped: “Some actors present the incorrect picture on social media.”

Google AdSense
How To6 days ago

How To Receive Google AdSense Payment To GTB, UBA, Access, FCMB, First Bank – SWIFT – BIC CODE

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 12)

Monalisa Chida claims the abductor's phone may be used to find kidnapped Nollywood actors.
Celebrity5 days ago

Monalisa Chida claims the abductor’s phone may be used to find kidnapped Nollywood actors.

Sports5 days ago

The representatives of Victor Osimhen call a CRUNCH meeting to debate the future of Napoli.

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories3 days ago

[STORY] THE WITCH’S DAUGHTER (Final Episode 09)

Kcee Marzz incorporates highlife in his latest song, "In the air,"
Entertainment6 days ago

Kcee Marzz incorporates highlife in his latest song, “In the air,”

Epic movie "Anikulapo" by Kunle Afolayan is scheduled to premiere in September
Entertainment5 days ago

Epic movie “Anikulapo” by Kunle Afolayan is scheduled to premiere in September

Nancy Isime
Entertainment5 days ago

“Nancy Isime Did Butt Enlargement Surgery” – Blessing Okoro Makes Shocking Revelation

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 02)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 06)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 08)

Danielle's graduation is a cause for celebration for Jay-Jay Okocha.
Sports6 days ago

Danielle’s graduation is a cause for celebration for Jay-Jay Okocha.

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 10)

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 11)

Nkem Owoh
Entertainment3 days ago

Nkem Owoh Breaks Silence On Claims He Rejected N10 Million To Endorse Bola Tinubu For President

Money Over Love story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] MONEY OVER LOVE (Episode 14)

ANE's Billboard Hots



Join "ANE sabi" clique

Don't miss a thing, get ogbonge ANE latest updates to fuel your conversation daily.