WordPress Admins Urged to Remove miniOrange Plugins Due to Critical Flaw

WordPress people of miniOrange’s Malware Scanner and Web Software Firewall plugins are becoming urged to delete them from their internet websites subsequent the discovery of a critical security flaw.

The flaw, tracked as CVE-2024-2172, is rated 9.8 out of a utmost of 10 on the CVSS scoring method. It impacts the following variations of the two plugins –

• Malware Scanner (versions <= 4.7.2)
• Web Application Firewall (versions <= 2.1.1)

It’s worth noting that the plugins have been permanently closed by the maintainers as of March 7, 2024. While Malware Scanner has over 10,000 active installs, Web Application Firewall has far more than 300 active installations.

“This vulnerability helps make it achievable for an unauthenticated attacker to grant on their own administrative privileges by updating the user password,” Wordfence described final 7 days.

The issue is the result of a lacking capability check in the function mo_wpns_init() that allows an unauthenticated attacker to arbitrarily update any user’s password and escalate their privileges to that of an administrator, possibly primary to a entire compromise of the web site.

“As soon as an attacker has obtained administrative consumer accessibility to a WordPress website they can then manipulate just about anything on the focused website as a regular administrator would,” Wordfence claimed.

“This involves the means to upload plugin and theme information, which can be destructive zip files made up of backdoors, and modify posts and pages which can be leveraged to redirect internet site consumers to other destructive web-sites or inject spam information.”

The enhancement arrives as the WordPress security company warned of a similar higher-severity privilege escalation flaw in the RegistrationMagic plugin (CVE-2024-1991, CVSS rating: 8.8) influencing all versions, such as and prior to 5.3…

The issue, tackled on March 11, 2024, with the release of edition 5.3.1., permits an authenticated attacker to grant themselves administrative privileges by updating the user part. The plugin has extra than 10,000 active installations.

“This vulnerability lets authenticated danger actors with subscriber-level permissions or bigger to elevate their privileges to that of a web page administrator which could in the end lead to entire site compromise,” István Márton stated.

Uncovered this report fascinating? Adhere to us on Twitter  and LinkedIn to go through additional exclusive content material we publish.

Some parts of this article are sourced from:
thehackernews.com