Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Hackers are attacking another serious WordPress security flaw - here's how to keep your site safe

Wordpress brand logo on computer screen. Man typing on the keyboard.

Cybercriminals have been spotted abusing a known, high-severity vulnerability in a popular WordPress plugin, just a day after a proof-of-concept (PoC) exploit was published.

Cybersecurity researchers from PatchStack discovered a cross-site script (XSS) vulnerability in Advanced Custom Fields, a popular plugin for the WordPress website builder, with more than two million active installs. 

The flaw, tracked as CVE-2023-30777, allowed threat actors to steal sensitive data from visitors and, in some cases, take over the website, entirely.

Fast-moving crooks

PatchStack discovered the vulnerability on May 2, and published a report on May 5 together with the PoC. In the meantime Delicious Brains, the plugin’s operators, released a security update, bringing the plugin to version 6.1.6.

Now, crooks are betting on most website administrators not yet having updated their virtual real estate, which would make their website vulnerable to this 6.1/10 flaw. 

"The Akamai SIG analyzed XSS attack data and identified attacks starting within 24 hours of the exploit PoC being made public," the company’s report claims. "What is particularly interesting about this is the query itself: The threat actor copied and used the Patchstack sample code from the write-up."

Official WordPress.org stats state that fewer than a third of all users (31.7%) updated the plugin to the 6.1. version, meaning hackers have quite a few websites to attack. BleepingComputer’s report states that at least 1.4 million sites are still vulnerable to this XSS flaw. 

"This vulnerability allows any unauthenticated user [to steal] sensitive information to, in this case, privilege escalation on the WordPress site by tricking the privileged user to visit the crafted URL path," Patchstack said. "This vulnerability could be triggered on a default installation or configuration of Advanced Custom Fields plugin. The XSS also could only be triggered from logged-in users that have access to the Advanced Custom Fields plugin," the researchers concluded.

This is the fourth major vulnerability to be found in this plugin in the last couple of years.

Via: BleepingComputer

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.