[[{“value”:”
Hackers often target WordPress plugins as they have security loopholes that they can exploit to hack into sites without permission.
Once they have found them, threat actors can insert corrupted scripts into these loopholes to compromise the system, obtain secret data, and carry out any other attack that serves their requirements.
Cybersecurity researchers at WPScan recently discovered that hackers have been actively exploiting the WP Automatic updates plugin vulnerability, tracked as “CVE-2024-27956.”
Flaw Profile
CVE ID: CVE-2024-27956
WP‑Automatic Vulnerable Versions: < 3.9.2.0
CVSSv3.1: 9.8
CVSS severity: High
Fixed in: 3.92.1
Classification: SQL Injection
Patch priority: High
WP Automatic Updates Under Attack
This critical flaw in the WP-Automatic plugin allows threat actors to bypass authentication, create admin accounts, upload malicious files, and potentially compromise affected websites through a SQL injection vulnerability that was discovered a few weeks ago.
The problem is due to incorrect user authentication handling, which permits the injection of harmful SQL queries.
Is Your Network Under Attack? – Read CISO’s Guide to Avoiding the Next Breach – Download Free Guide
On 13 March, PatchStack released it publicly and recorded over 5.5 million attempts at attack, which peaked on 31 March after gradually increasing. This security hole is very dangerous as it can result in a complete site takeover.
Attackers exploit the SQL Injection (SQLi) vulnerability by injecting malicious SQL queries that create admin accounts, upload web shells and backdoors, and rename the plugin file being exploited for continuous use.
Afterward, they install plugins that allow more code editing and file uploads while hiding their tracks.
Owners, security tools, and other threat actors can be blocked and remain undetected by renaming the plugin file.
Persistence is achieved through full control as threat actors apply backdoors to control them using different malicious plugins or themes.
Mitigations
Here below, we have mentioned all the mitigations recommended by the cybersecurity analysts:-
Make sure to keep the WP‑Automatic plugin updated to the latest version to patch any known vulnerabilities and ensure security.
Regularly audit WordPress user accounts to remove unauthorized or suspicious admin users, which helps reduce the risk of unauthorized access.
Always utilize robust security monitoring tools like Jetpack Scan to detect and respond to malicious activity promptly.
Maintain up-to-date backups of your website data to enable quick restoration in case of a compromise, ensuring minimal downtime and data loss.
IoCs
Administrator user with name starting with xtw.
The vulnerable file “/wp‑content/plugins/wp‑automatic/inc/csv.php” renamed to something as “/wp‑content/plugins/wp‑automatic/inc/csv65f82ab408b3.php”
The following SHA1 hashed files dropped in your site’s filesystem:
b0ca85463fe805ffdf809206771719dc571eb052 web.php
8e83c42ffd3c5a88b2b2853ff931164ebce1c0f3 index.php
Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo
The post Hackers Actively Exploiting WP Automatic Updates Plugin Vulnerability appeared first on Cyber Security News.
“}]] Read More
Cyber Security News