Ethical Hacking News
Critical WordPress plugin flaws expose 200,000+ sites to remote attacks, putting millions of users at risk. Find out how you can protect yourself from this devastating vulnerability.
The CleanTalk anti-spam plugin for WordPress has a critical security flaw with a CVSS score of 9.8, allowing unauthorized arbitrary plugin installation. A missing empty value check on the 'api_key' value in all versions up to 6.44 allows attackers to install and activate malicious plugins. There are two vulnerabilities: authorization bypass via reverse DNS spoofing (CVE-2024-10542) and a more general vulnerability allowing installation, activation, deactivation, or uninstallation of any plugin (no CVE mentioned). The impact is significant with over 200,000 sites affected, estimated tens of thousands of websites that could be compromised by malicious actors. Compromised WordPress sites can be used to inject malware and execute arbitrary PHP code. Webmasters should update to the latest patched version of the plugin and implement robust security measures, including regular updates, password policies, and log monitoring.
In a shocking revelation that has left thousands of webmasters reeling, a critical security flaw has been discovered in the popular CleanTalk anti-spam plugin for WordPress. The vulnerability, tracked as CVE-2024-10542 and CVE-2024-10781, carries an alarming CVSS score of 9.8 out of a maximum of 10.0, indicating a severe level of severity.
According to security researcher István Márton, the plugin is vulnerable to unauthorized arbitrary plugin installation due to a missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This means that an attacker could potentially install and activate any malicious plugin, paving the way for remote code execution if the activated plugin is vulnerable of its own.
On the other hand, CVE-2024-10542 stems from an authorization bypass via reverse DNS spoofing on the checkWithoutToken() function. Regardless of the bypass method, successful exploitation of the two shortcomings could allow an attacker to install, activate, deactivate, or even uninstall plugins.
The impact of this vulnerability is significant, with over 200,000 sites affected by the CleanTalk plugin. The majority of these sites are likely small to medium-sized businesses and individual bloggers who rely on the plugin for anti-spam protection. Given the widespread adoption of the plugin, it is estimated that tens of thousands of websites could be compromised by malicious actors.
Sucuri has warned of multiple campaigns that are leveraging compromised WordPress sites to inject malicious code responsible for redirecting site visitors to other sites via bogus ads, skimming login credentials, as well as drop malware that captures admin passwords, redirects to VexTrio Viper scam sites, and execute arbitrary PHP code on the server.
In light of this alarming discovery, it is essential for webmasters who rely on the CleanTalk plugin to take immediate action. Updating to the latest patched version of the plugin is the only way to safeguard against potential threats. However, this may not be enough, as many plugins are also vulnerable to exploitation by attackers who have already compromised other sites.
The discovery of this critical vulnerability serves as a stark reminder of the importance of regular security updates and patch management. It highlights the need for webmasters to stay vigilant and proactive in protecting their websites from malicious attacks.
In addition to updating the CleanTalk plugin, webmasters should also take steps to strengthen their overall security posture. This includes implementing robust password policies, keeping software up-to-date, and regularly monitoring website logs for suspicious activity.
The CleanTalk vulnerability is a wake-up call for WordPress users, serving as a stark reminder of the importance of prioritizing cybersecurity in the digital age. By staying informed and taking proactive steps to protect their websites, webmasters can minimize the risk of compromise and ensure the long-term security of their online presence.
Related Information:
https://thehackernews.com/2024/11/critical-wordpress-anti-spam-plugin.html
Published: Tue Nov 26 11:11:22 2024 by llama3.2 3B Q4_K_M
