P0wned plugin puts a million Word Press sites at risk of attack

[Reefa]

Up to one million Word Press websites could be open to full compromise through a vulnerability in the WP-Slimstat plugin, security bod Marc-Alexandre Montpas says.

The weak key flaw can expose credentials, bad news for the folks who've downloaded the plugin 1.3 million times.

A patched version of the code has been released and WordPress has fine auto-update features, but not everyone uses those and all prior versions of the software have the problem, making it a ripe attack vector.

“This bug can be used by any visitor browsing the vulnerable website – if your website uses a vulnerable version of the plugin, you’re at risk,”, says Montpas, of from plugin-plower firm Sucuri.

“Successful exploitation of this bug could lead to blind SQL injection attacks, which means an attacker could grab sensitive information from your database, including username, hashed passwords and, in certain configurations, WordPress secret keys which could result in a total site takeover.

“This is a dangerous vulnerability, you should update all of your websites using this plugin as soon as possible.”

Object injection vulnerabilities are also possible depending on a target site's installed plugins.

The patch means the security of the plugin's SQL queries is better and its encryption key are harder to guess, developers say.

"If you are using a caching plugin, please flush its cache so that the tracking code can be regenerated with the new key," WordPress bods warn in the plugin changelog.

"Also, if you are using Slimstat to track external websites, please make sure to replace the tracking code with the new one."

WordPress plugins are a favourite of hackers, and of Sucuri. Earlier this month fellow security boffin Daniel Cid reported FancyBox then downloaded 500,000 times contained a flaw that bad guys were using in zero day attacks, leading him to urge admins to remove the plugin.

That followed Cid's June report that 50,000 sites had been sprayed with malware.

In the same month, Montpas found the All in One SEO plugin then downloaded 19 million times allowed attackers to trash a sites' SEO rep through cross-site scripting and privilege escalation attack.

http://www.theregister.co.uk/2015/02/26/plugin_puts_a_million_word_press_sites_at_risk_of_compromise/