Serious flaw found and patched in WordPress, but it might lurk in plugins

The bug appears in WordPress instances prior to version 4.9.9 and was exploitable for as long as six years, the RIPS Technologies researchers said.

WordPress recently patched a long-running, potentially serious vulnerability in its core code. But a similar flaw in third-party plugins could still allow hackers to take over websites that use the popular publishing software, according to German web security company RIPS Technologies.

Exploiting the vulnerability requires an attacker to have access to an account with “author” privileges for the target website — a common designation for WordPress users. Once logged in, a hacker could manipulate how WordPress reads and writes files in its image database, essentially tricking the software into saving a malicious script file into a directory that typically handles photos.

“An attacker who gains access to an account with at least author privileges on a target WordPress site can execute arbitrary PHP code on the underlying server, leading to a full remote takeover,” RIPS researcher Simon Scannell wrote in a blog post Tuesday.

The bug — which RIPS is categorizing as a “path traversal” vulnerability — is exploitable WordPress instances prior to version 4.9.9 and has been for as long as six years, the researchers said, noting that the software runs on about one-third of all websites.

Even if all WordPress websites patched their core code, though, the software would still be vulnerable to the flaw via plugins, Scannell wrote.

“Any WordPress site with a plugin installed that incorrectly handles Post Meta entries can make exploitation still possible,” the RIPS team said, referring to the part of the code that handles image metadata. … Considering that plugins might reintroduce the issue and taking in factors such as outdated sites, the number of affected installations is still in the millions,” Scannell wrote.

WordPress plugins have recently been in the news for vulnerabilities. Last week the Simple Social plugin was patched for a flaw that could have affected 40,000 websites, and in November, a serious bug was found in a plugin related to compliance with Europe’s new data protection rules.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure