WooCommerce Patches Critical Plugin Flaw Affecting Half a Million Sites

Susceptible code has been found out in the payment option plugin WooCommerce for the WordPress articles administration program (CMS) that could make it possible for an unauthenticated attacker to attain administrative privileges and get around a internet site.

The conclusions appear from WordPress security experts at Wordfence, who explained the critical authentication bypass in a weblog post revealed on Thursday.

Examine more on WordPress plugin vulnerabilities in this article: Large Severity WordPress Plugin Bug Hits A few Million

The Wordfence web site write-up, published by senior risk researcher Ram Gall, describes how the group identified the vulnerability right after examining variation 5.6.2 of the WooCommerce plugin on the very same working day it was unveiled.

“After examining the update, we established that it removed susceptible code that could allow an unauthenticated attacker to impersonate an administrator and fully take above a site without having any user interaction or social engineering demanded,” Gall wrote.

The researcher also clarified that the changelog entry for the 5.6.2 plugin only confirmed “Security update” without the need of mentioning particulars of the critical flaw it patched.

“Regardless of the version of Wordfence you are utilizing, we urge you to update to the hottest model of the WooCommerce Payments plugin, which is 5.6.2 as of this creating, straight away,” Gall warned. “WooCommerce Payments is put in on around 500,000 internet sites, and this is a critical-severity vulnerability.

Gall also clarified that the Wordfence team is not knowledgeable of whether this flaw was found out internally by Automattic (the developer powering WooCommerce) or described by an exterior researcher. Wordfence has not yet identified cases of the vulnerability remaining exploited in the wild, but that could alter in the around foreseeable future.

“We be expecting to see massive-scale attacks concentrating on this vulnerability as soon as a proof of concept turns into offered to attackers,” Gall included.

The flaw comes months immediately after Sucuri security scientists noticed a malware campaign created to improve the look for engine rankings of in excess of 15,000 spam WordPress and other websites.

Some parts of this article are sourced from:
www.infosecurity-magazine.com