Over 2 lakh WordPress websites vulnerable to hacking due to plugin bug

More than 2 lakh WordPress websites are on the hacking threat due to a essential unpatched safety vulnerability that was being actively exploited by malicious actors.

According to WordPress safety agency WPScan, the bug is current within the Ultimate Member plugin, which is a free consumer profile WordPress plugin that makes it simple to create highly effective on-line communities and membership websites with WordPress.

“This is a really severe situation as unauthenticated attackers might exploit this vulnerability to create new consumer accounts with administrative privileges, giving them the facility to take full management of affected websites,” the safety agency warned.

There was “no full repair to this situation” and worryingly, “there have been indications that this situation was being actively exploited by malicious actors,” the agency added.

In response to the vulnerability report, the creators of the plugin promptly launched a brand new model, 2.6.4, intending to repair the issue.

“However, upon investigating this replace, we discovered quite a few strategies to circumvent the proposed patch, implying the problem remains to be absolutely exploitable,” the WPScan workforce famous.

The pluginoperates by utilizing a pre-defined checklist of consumer metadata keys that customers mustn’t manipulate.

It makes use of this checklist to verify if customers try to register these keys when creating an account.

“Unfortunately, variations in how the Ultimate Member’s blocklist logic and the way WordPress treats metadata keys made it doable for attackers to trick the plugin into updating some it should not,” mentioned the workforce.

The safety researchers suggest that the customers ought to disable the Ultimate Member plugin till a patch that fully remediates this safety situation is made out there.

Sites on WP.cloud hosts, similar to WordPress.com and Pressable.com, have obtained a platform-level patch to assist mitigate the vulnerability.

(With inputs from IANS)