WordPress force updates thousands of websites following WooCommerce security breach
Major flaw discovered in WooCommerce WordPress add-on
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Topwebsite builderWordPress has pushed an urgent update to users with the WooCommerce add-on installed in response to a highly disruptive security vulnerability.
Cybersecurity researchers from GoldNetwork recently discovered a major flaw affecting WooCommerce Payments 4.8.0 and higher. WooCommerce is an open-source ecommerceWordPress plugindesigned to service small and medium-sized businesses.
Explaining the bug in more detail, researchers from WordFence (a cybersecurity team focused on WordPress) claim the bug allows threat actors to “impersonate an administrator and completely take over a website without any user interaction or social engineering required.”
Disaster avoided
WooCommerce devs have now released a security update, and the good news (or so it seems right now) is that the Swiss researchers were the first ones to discover the flaw.
“At this time we have no evidence that the vulnerability was exploited beyond identifying it in our own security testing program. We do not believe any store or customer data was compromised as a result of this vulnerability,“BleepingComputercited Beau Lebens, Head of Engineering at WooCommerce.
“We immediately deactivated the impacted services and mitigated the issue for all websites hosted on WordPress.com, Pressable, and WPVIP.”
10 reasons why WooCommerce is the perfect partner for an ecommerce website>WooCommerce ecommerce platform review>Check out the best endpoint protection services right now
If you have a WordPress site with WooCommerce, chances are it’s already been updated: “We shipped a fix and worked with the WordPress.org Plugins Team to auto-update sites running WooCommerce Payments 4.8.0 through 5.6.1 to patched versions. The update is currently being automatically rolled out to as many stores as possible,” Lebens said.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Here are all the vulnerable WooCommerce Payments versions: .8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, and 5.6.2.
If your website is still running any of the above mentioned versions, chances are it still hasn’t been updated. To do so manually, head to your WP Admin dashboard, navigate to Plugins, find WooCommerce Payments, and look for a notification about the vulnerability, as well as the instructions on how to update.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
How to watch Wolf Hall: The Mirror and the Light FREE online from anywhere
