Mass Exploitation of Unpatched Plugins in WordPress
- Critical vulnerabilities in GutenKit and Hunk Companion plugins are under attack
- Malicious ‘up’ plugin leveraged for unauthorized admin access
- Wordfence thwarts 8.7 million assault attempts within 48 hours; urgent updates are necessary
Recent reports reveal the existence of three critical vulnerabilities, initially identified and rectified over a year ago, that are now being exploited in widespread attacks against unmaintained websites.
According to security specialists at Wordfence, more than 8.7 million malicious attempts were thwarted in just two days, utilizing the GutenKit and Hunk Companion plugins.
The GutenKit plugin enhances the Gutenberg editor, offering a multitude of blocks, templates, and layout configurations. Conversely, the Hunk Companion serves as a supplementary tool for ThemeHunk themes, incorporating features such as “team,” “services,” “portfolio,” and “sliders.”
Unveiling Malicious Payload on GitHub
Between October and December 2024, three significant flaws—CVE-2024-9234, CVE-2024-9707, and CVE-2024-11972—were discovered and subsequently patched in these plugins. Each of these vulnerabilities received a critical rating of 9.8/10, enabling attackers to install arbitrary plugins and execute malicious code on susceptible sites.
Currently, attackers are capitalizing on the negligence of many site administrators who have failed to implement necessary updates.
Wordfence indicates that hackers are employing these vulnerabilities to introduce a malicious plugin called ‘up,’ which is distributed as a .ZIP file on GitHub.
This insidious plugin grants attackers the ability to upload, download, or delete files from the compromised site, as well as manipulate site permissions. In addition, it enables immediate administrative access to the vulnerable website.
Furthermore, the attackers utilize the ‘up’ plugin for persistent access, data exfiltration, and to deploy additional malware.
As a prominent platform, WordPress attracts cybercriminals due to its widespread use. While generally deemed secure, the inherent vulnerabilities of themes and plugins, particularly those that lack ongoing support, make them prime targets.
The optimal strategy to mitigate risks entails retaining only the essential plugins and themes while ensuring they are consistently updated.
Source link: Techradar.com.
