WordPress Vulnerability Worries Companies as Hackers Close In

WordPress has become one of the most popular platforms for setting up everything from blogs to corporate websites, but reports of a WordPress vulnerability may have some organizations worried about the security of their entire online presence.

A Sucuri researcher was among the first to describe the details of the WordPress vulnerability, which could allow hackers to gain access to the database of sites or blogs using a particular WordPress “theme” (the files or templates that provide the look and feel of what online users see). A plugin called Slider Revolution, used in many such themes, has a vulnerability whereby third parties could access, view or download a file from WordPress sites that use it. This is known as a Local File Inclusion (LFI) attack.

The WordPress vulnerability has been an issue for months, according to researchers at Trustwave, but it was only a few weeks ago that anyone posted data about it online. This resulted in hackers scanning for websites that could be exploited through an LFI attack, the firm said.

PC Advisor contacted ThemePunch, the developer of Slider Revolution that is owned by Germany-based Dajomo, and was told via email that automatic updates to the plugin may not have been turned on in some of the themes it is bundled in. The company said Slider Revolution was updated in February to address the WordPress vulnerability, but Sucuri said it was a mistake to patch the problem quietly without raising more awareness around it.

“This is an example of where things go terribly wrong,” Daniel Cid of Sucuri said.

According to Forbes, WordPress is used by close to one-fifth of all websites, making it a huge potential target for hackers who want to find a way into the databases of all sorts of organizations. The story pointed to a free online service called WPScan that can be used to keep track of potential threats as they emerge.

In the meantime, a marketplace for WordPress themes called Evato has created a comprehensive walk-through of how to best check for security problems with Slider Revolution and ensure the plugin and related themes are up-to-date. This particular vulnerability only affects versions older than 4.2., and the latest version of Slider Revolution, 4.6, was released on Aug. 25.

As organizations increasingly move away from custom-built websites and leverage standardized themes and components, tracking these kinds of threats needs to become more of a priority. WordPress makes it easy to get content online, but it shouldn’t make it any easier for hackers to see the information companies want to keep offline.

Image source: Flickr

Shane Schick

Writer & Editor

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

When ransomware kills: Attacks on healthcare facilities

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

4 trends in software supply chain security

Topic updates