Hackers are attacking another serious WordPress security flaw - here’s how to keep your site safe
A patch is available, make sure to apply it
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybercriminals have been spotted abusing a known, high-severity vulnerability in a popularWordPress plugin, just a day after a proof-of-concept (PoC) exploit was published.
Cybersecurity researchers from PatchStack discovered a cross-site script (XSS) vulnerability in Advanced Custom Fields, a popular plugin for the WordPresswebsite builder, with more than two million active installs.
The flaw, tracked as CVE-2023-30777, allowed threat actors to steal sensitive data from visitors and, in some cases, take over the website, entirely.
Fast-moving crooks
PatchStack discovered the vulnerability on May 2, and published a report on May 5 together with the PoC. In the meantime Delicious Brains, the plugin’s operators, released a security update, bringing the plugin to version 6.1.6.
Now, crooks are betting on most website administrators not yet having updated their virtual real estate, which would make their website vulnerable to this 6.1/10 flaw.
“The Akamai SIG analyzed XSS attack data and identified attacks starting within 24 hours of the exploit PoC being made public,” the company’s report claims. “What is particularly interesting about this is the query itself: The threat actor copied and used the Patchstack sample code from the write-up.”
10 reasons why WooCommerce is the perfect partner for an ecommerce website>WooCommerce ecommerce platform review>What is WordPress hosting?
Official WordPress.org stats state that fewer than a third of all users (31.7%) updated the plugin to the 6.1. version, meaning hackers have quite a few websites to attack. BleepingComputer’s report states that at least 1.4 million sites are still vulnerable to this XSS flaw.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
“This vulnerability allows any unauthenticated user [to steal] sensitive information to, in this case, privilege escalation on the WordPress site by tricking the privileged user to visit the crafted URL path,” Patchstack said. “This vulnerability could be triggered on a default installation or configuration of Advanced Custom Fields plugin. The XSS also could only be triggered from logged-in users that have access to the Advanced Custom Fields plugin,” the researchers concluded.
This is the fourth major vulnerability to be found in this plugin in the last couple of years.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Google TV will require more RAM for future upgrades – which might leave older TVs and streaming boxes behind
