WordPress Plugin Leaves 1 Million Websites Vulnerable to Hackers

Wordfence researchers have found two vulnerabilities in a popular plugin installed on over 1 million websites built around the WordPress platform. Security holes can allow hackers to install and delete extensions and access potentially sensitive information about a website’s configuration.

Problems were found in the Gutenberg Template Library & Redux Framework plugin, which should be updated as soon as possible, researchers recommend. “While neither flaw can be used directly to take control of a website, both vulnerabilities can be useful tools in the hands of a skilled attacker,” they say.

Vulnerabilities found

Sensitive website data can be exposed by security holes in WordPress plugins.  (Source: Pixabay/Werner Moser/Reproduction)Sensitive website data can be exposed by security holes in WordPress plugins. (Source: Pixabay/Werner Moser/Reproduction)Source: Pixabay/Werner Moser/Reproduction

The first bug (CVE-2021-38312) is considered to be of high severity and is rated 7.1 on a scale of up to 10 on the Common Vulnerability Scoring System (CVSS). The security hole comes with the use of the REST API plugin, which processes requests to install and manage Gutemberg system blocks.

The flaw affects the site’s permissions and ends up creating points of vulnerability. Users with less privileges, such as contributors and authors, would have the ability to install any plugin on the site, the company points out.

The second vulnerability (CVE-2021-38314) has medium severity and is rated at 5.3 on the CVSS scale. The error could be used to obtain potentially confidential information such as PHP version, active plugins on the site and their versions. The data can be used in more robust attacks, including possible intrusion.

recurring problems

Problems with WordPress plugins are quite recurrent. Among the extensions with the most serious vulnerabilities recently discovered is Plus Addons for Elementor, whose code can be used by hackers to take control of a website quickly, easily and remotely. Another notorious flaw, released in May, is “Spam protection, AntiSpam, FireWall by CleanTalk,” which can expose a user’s email, passwords, credit card data and other sensitive information to an attacker.