Researchers Uncover Active Exploitation of WordPress Plugin Vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-40000 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.T Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7. NVD description · AI analysis pending | 6.1 | 55% | PoC |
| — | |
| CVE-2023-6961 | The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to i The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NVD description · AI analysis pending | 6.1 | <1% |
| — | ||
| CVE-2024-2194 | The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NVD description · AI analysis pending | 7.2 | 68% |
| — |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | mystiqueapi.com | ontaining the HTTP host information to a remote server ("ur.mystiqueapi[.]com/?ur"). Fastly said it detected a significant proportion o |
Full article323 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 30, 2024WordPress / Website Security
Cybersecurity researchers have warned that multiple high-severity security vulnerabilities in WordPress plugins are being actively exploited by threat actors to create rogue administrator accounts for follow-on exploitation.
"These vulnerabilities are found in various WordPress plugins and are prone to unauthenticated stored cross-site scripting (XSS) attacks due to inadequate input sanitization and output escaping, making it possible for attackers to inject malicious scripts," Fastly researchers Simran Khalsa, Xavier Stevens, and Matthew Mathur said.
The security flaws in question are listed below -
- CVE-2023-6961 (CVSS score: 7.2) - Unauthenticated Stored Cross-Site Scripting in WP Meta SEO <= 4.5.12
- CVE-2023-40000 (CVSS score: 8.3) - Unauthenticated Stored Cross-Site Scripting in LiteSpeed Cache <= 5.7
- CVE-2024-2194 (CVSS score: 7.2) - Unauthenticated Stored Cross-Site Scripting in WP Statistics <= 14.5
Attack chains exploiting the flaws involve injecting a payload that points to an obfuscated JavaScript file hosted on an external domain, which is responsible for creating a new admin account, inserting a backdoor, and setting up tracking scripts.
The PHP backdoors are injected into both plugin and theme files, while the tracking script is designed to send an HTTP GET request containing the HTTP host information to a remote server ("ur.mystiqueapi[.]com/?ur").
Fastly said it detected a significant proportion of the exploitation attempts originating from IP addresses associated with the Autonomous System (AS) IP Volume Inc. (AS202425), with a chunk of it coming from the Netherlands.
It's worth noting that WordPress security company WPScan previously disclosed similar attack efforts targeting CVE-2023-40000 to create rogue admin accounts on susceptible websites.
To mitigate the risks posed by such attacks, it's recommended that WordPress site owners review their installed plugins, apply the latest updates, and audit the sites for signs of malware or the presence of suspicious administrator users.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/05/researchers-uncover-active-exploitation.html