Cybercriminals have exploited zero-days in the wild that affect three WordPress plugins, Wordfence, a WordPress security firm, said in an advisory published.
The zero-days affect three WordPress plugins are:
- Appointments by WPMU Dev (fixed in version 2.2.2)
- Flickr Gallery by Dan Coulter (fixed in version 1.5.3)
- RegistrationMagic-Custom Registration Forms by CMSHelpLive (fixed in version 184.108.40.206)
The plugins’ authors released updates to fix the attack vector — a PHP object injection vulnerability that affects all three plugins in the same way.
0-days allow hackers to install backdoors on vulnerable sites
“This vulnerability allowed attackers to cause a vulnerable website to fetch a remote file (a PHP backdoor) and save it to a location of their choice,” says Wordfence researcher Brad Haas.
According to Haas, the vulnerability is hilariously easy to exploit, requiring the attackers to package the exploit code inside an HTTP POST request sent to the victim site. Attackers don’t need to be authenticated on the site to trigger the exploit.
For sites running the Flickr Gallery plugin, the hacker has to target the site’s root URL, while for the other two, the hacker has to aim the POST request at the admin-ajax.php file.
Once the hacker tricked sites into downloading the backdoor, he can take over sites within minutes.
Only 21,000 sites vulnerable
Wordfence said it detected the zero-days after investigating a series of hacked sites and finding evidence of past exploitation.
There is good and bad news. The good news is that the plugins are not that popular, having around 21,000 installations combined.
The bad news is that the zero-days are easy to exploit and other hackers can reverse engineer the plugin changelogs to deduce the exploit code.
The vulnerability at the core of these zero-days has a score of 9.8 out of 10 on the CVSSv3 severity scale, which is very high, and classifies the vulnerability as “Critical.”
Website developer can update the plugins to the patched versions, or they can uninstall the plugins.