Researchers Uncover Active Exploitation of WordPress Plugin Vulnerabilities

31-05-2024
Share
Researchers Uncover Active Exploitation of WordPress Plugin Vulnerabilities

Cybersecurity researchers have warned that multiple high-severity security vulnerabilities in WordPress plugins are being actively exploited by threat actors to create rogue administrator accounts for follow-on exploitation.

“These vulnerabilities are found in various WordPress plugins and are prone to unauthenticated stored cross-site scripting (XSS) attacks due to inadequate input sanitization and output escaping, making it possible for attackers to inject malicious scripts,” Fastly researchers Simran Khalsa, Xavier Stevens, and Matthew Mathur said.

The security flaws in question are listed below –

  • CVE-2023-6961 (CVSS score: 7.2) – Unauthenticated Stored Cross-Site Scripting in WP Meta SEO <= 4.5.12
  • CVE-2023-40000 (CVSS score: 8.3) – Unauthenticated Stored Cross-Site Scripting in LiteSpeed Cache <= 5.7
  • CVE-2024-2194 (CVSS score: 7.2) – Unauthenticated Stored Cross-Site Scripting in WP Statistics <= 14.5

Fastly said it detected a significant proportion of the exploitation attempts originating from IP addresses associated with the Autonomous System (AS) IP Volume Inc. (AS202425), with a chunk of it coming from the Netherlands.

WordPress Plugin Vulnerabilities

It’s worth noting that WordPress security company WPScan previously disclosed similar attack efforts targeting CVE-2023-40000 to create rogue admin accounts on susceptible websites.

To mitigate the risks posed by such attacks, it’s recommended that WordPress site owners review their installed plugins, apply the latest updates, and audit the sites for signs of malware or the presence of suspicious administrator users.

 

Source: https://thehackernews.com/