WordPress (WP) is by far the most popular open source Content management system (CMS) used by approximately 75 million websites. The ease to deploy and upgrade this free tool makes it popular among web- savvy users and web- novices alike. Whether it’ a commercial site or a personal blog, the fact that WordPress doesn’t charge a penny makes it a preferable tool among people.
The compatibility and flexibility of Word Press to host thousands of plugins and templates gives it an edge over its contemporaries. However, the popularity of this tool among users has made this popular tool a lucrative target among threat actors.
Recent research reveals that vulnerability in a high profile WordPress plugin that is installed on more than 100,000 sites has come under active exploitation. The vulnerability discovered in the popular AMP (Accelerated Mobile Pages) for WP plugin allows any registered user to perform administrative actions on a WordPress site.
The compatibility of a website may vary on mobile platform. For instance, the speed of loading a website, the view of the website and many other features may differ in mobile devices. This may have an impact on web traffic and affect site’s ranking as well.
AMP plugins for WordPress were designed to enable seamless website usability from any mobile viewing device. These plugins ensure that the viewers take full advantage of the website’s features when using mobile viewing device.
Older versions of AMP plugin for WordPress are prone to security vulnerabilities that make it a lucrative target for XSS attack (cross-site scripting attack). An active XSS campaign targets these vulnerabilities to create rogue admin accounts on a vulnerable WordPress site.
In WordPress plugin development, you have the provision to register ajax hooks. Ajax is a technology that lets you update content on a webpage without having to reload it in the browser. This means, you can fetch data from the database and display it on the front-end without needing to refresh the page.
The main issue with this approach is that every registered user can call ajax hooks. If the called hook doesn’t perform the authorization check, every user can make a use of those functions and inject the following XSS payload into vulnerable sites:
This malicious script when executed in administrator’s browser affects the website in the following ways:
In the updated version, the plugin performs an authorization check that allows only admin users to update plugin settings.
It is therefore recommended that site owners using AMP for WP plugin update to the most recent version (0.9.97.20) of this plugin as soon as possible.
Subscribe to our newsletter today to receive updates on the Latest News and Threats.
The researchers at Virus Removal Guidelines are dedicated to track down the latest vulnerabilities which may infringe your system security. Our team of expert performs a detailed research about every malware infection before educating our users about the same.
Want to stay informed about the latest threats & malware? Sign up for our newsletter & learn how to get rid of all types of threats from your computer.