Over 280,000 WordPress Sites Attacked Using WPGateway Plugin Zero-Day Vulnerabil...
source link: https://thehackernews.com/2022/09/over-280000-wordpress-sites-attacked.html
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Over 280,000 WordPress Sites Attacked Using WPGateway Plugin Zero-Day Vulnerability
A zero-day flaw in the latest version of a WordPress premium plugin known as WPGateway is being actively exploited in the wild, potentially allowing malicious actors to completely take over affected sites.
Tracked as CVE-2022-3180 (CVSS score: 9.8), the issue is being weaponized to add a malicious administrator user to sites running the WPGateway plugin, WordPress security company Wordfence noted.
"Part of the plugin functionality exposes a vulnerability that allows unauthenticated attackers to insert a malicious administrator," Wordfence researcher Ram Gall said in an advisory.
WPGateway is billed as a means for site administrators to install, backup, and clone WordPress plugins and themes from a unified dashboard.
The most common indicator that a website running the plugin has been compromised is the presence of an administrator with the username "rangex."
Additionally, the appearance of requests to "//wp-content/plugins/wpgateway/wpgateway-webservice-new.php?wp_new_credentials=1" in the access logs is a sign that the WordPress site has been targeted using the flaw, although it doesn't necessarily imply a successful breach.
Wordfence said it blocked over 4.6 million attacks attempting to take advantage of the vulnerability against more than 280,000 sites in the past 30 days.
Further details about the vulnerability have been withheld owing to active exploitation and to prevent other actors from taking advantage of the shortcoming. In the absence of a patch, users are recommended to remove the plugin from their WordPress installations until a fix is available.
The development comes days after Wordfence warned of in-the-wild abuse of another zero-day flaw in a WordPress plugin called BackupBuddy.
The disclosure also arrives as Sansec revealed that threat actors broke into the extension license system of FishPig, a vendor of popular Magento-WordPress integrations, to inject malicious code that's designed to install a remote access trojan called Rekoobe.
Recommend
-
194
Behind the Masq: Yet more DNS, and DHCP, vulnerabilities ...
-
14
-
12
Tutorial How To Set Up Multiple WordPress Sites Using Multisite WordPress
-
8
AdvertisementThe runaway popularity of WordPress and the open source nature of the WordPress ecosystem has made it an intense target of hackers.
-
7
Understanding the Impact of Apache Log4j Vulnerability December 17, 2021 ...
-
7
Regular expressions come in handy when you need to search for and replace text. However, in some cases, they may cause the system to slow down or even make vulnerable to ReDoS attacks. Introduction ReDoS is a subtype of a
-
4
Google advises Android users to take action after finding 18 zero-day vulnerabilities in popular phones All an attacker needs is the target's phone number By
-
6
Researchers warn unpatched Fortinet firewalls are exposed to critical vulnerability
-
4
Links to sites that Elon Musk publicly attacked apparently load slower on X...
-
4
Can machines dream of secure code? From AI hallucinations to software vulnerabilitiesWritten by: Liran Tal
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK