Critical Security Risk Endangers Over 100,000 WordPress Websites: Vulnerability in Wishlist Plugin Explained
networks.
Vulnerability Details
Cybersecurity experts from NinTechNet have discovered the critical Common Vulnerability Scoring System (CVSS) 10.0 vulnerability in TI WooCommerce Wishlist plugin for WordPress.
This CVE-tagged flaw, open to exploitation by unauthenticated actors, permits arbitrary file uploads.
The vulnerability is a file upload type known as an “unauthenticated arbitrary file upload” vulnerability that grants a hacker the ability to upload malicious files onto a server.
In layman’s terms, this flaw can enable a cybercriminal to take full control of a website.
Specifically, the defect is in the plugin’s AJAX action feature.
The compromised AJAX endpoint `ti-wishlist-upload-image` does not have sufficient security checks or authentication, potentially leading to arbitrary file uploads that can be exploited further for arbitrary code execution (ACE).
Implications and Potential Damage
The reported vulnerability poses severe threats to web security, in particular to the owners of WooCommerce-based e-commerce stores.
A successful exploitation could allow an attacker to take control of a website, enabling them to perform actions such as data theft, defacement of the website, establishment of backdoors, and further spreading of malware to visitors of the site.
Current Status and Advice
As of now, there’s no patch available for this high-risk vulnerability.
Plugin developers, Template Invaders, have been notified by the researchers, but they have not yet taken effective actions to rectify or patch the problem.
For the meantime, website administrators using the said plugin are encouraged to disable it until a security patch becomes available.
The disabling act will remove any potential risks of exploitation and the eventual loss of sensitive data.
An alternate solution is to place the website behind a Web Application Firewall (WAF) which can block exploitation attempts.
Follow-Up Reading
Stay updated on the latest news and updates on this ongoing issue with these trusted sources:
- Official WordPress News
- WordPress plugin bug poses security risk – ZDNET
- WordPress plugin bug lets hackers take over sites – BleepingComputer
The situation is continually evolving, therefore keeping updated on the latest news will help WordPress site owners defend better against this critical vulnerability.
Cybersecurity is an endless battle and being one step ahead is the ultimate goal.
Stay informed and stay secure.
