Subj : Hackers are attacking another serious WordPress security flaw - h
To   : All
From : TechnologyDaily
Date : Tue May 16 2023 18:30:03

Hackers are attacking another serious WordPress security flaw - here's how to 
keep your site safe

Date:
Tue, 16 May 2023 17:10:06 +0000

Description:
A day after a PoC was released, hackers started looking for vulnerable 
WordPress sites.

FULL STORY
======================================================================

Cybercriminals have been spotted abusing a known, high-severity vulnerability 
in a popular WordPress plugin , just a day after a proof-of-concept (PoC) 
exploit was published. 

Cybersecurity researchers from PatchStack discovered a cross-site script 
(XSS) vulnerability in Advanced Custom Fields, a popular plugin for the 
WordPress website builder , with more than two million active installs. 

The flaw, tracked as CVE-2023-30777, allowed threat actors to steal sensitive 
data from visitors and, in some cases, take over the website, entirely. 
Fast-moving crooks 

PatchStack discovered the vulnerability on May 2, and published a report on 
May 5 together with the PoC. In the meantime Delicious Brains, the plugins 
operators, released a security update, bringing the plugin to version 6.1.6. 

Now, crooks are betting on most website administrators not yet having updated 
their virtual real estate, which would make their website vulnerable to this 
6.1/10 flaw. 

"The Akamai SIG analyzed XSS attack data and identified attacks starting 
within 24 hours of the exploit PoC being made public," the companys report 
claims. "What is particularly interesting about this is the query itself: The 
threat actor copied and used the Patchstack sample code from the write-up." 
Read more 

> 10 reasons why WooCommerce is the perfect partner for an ecommerce website 


 > WooCommerce ecommerce platform review 


 > What is WordPress hosting? 

Official WordPress.org stats state that fewer than a third of all users 
(31.7%) updated the plugin to the 6.1. version, meaning hackers have quite a 
few websites to attack. BleepingComputers report states that at least 1.4 
million sites are still vulnerable to this XSS flaw. 

"This vulnerability allows any unauthenticated user [to steal] sensitive 
information to, in this case, privilege escalation on the WordPress site by 
tricking the privileged user to visit the crafted URL path," Patchstack said. 
"This vulnerability could be triggered on a default installation or 
configuration of Advanced Custom Fields plugin. The XSS also could only be 
triggered from logged-in users that have access to the Advanced Custom Fields 
plugin," the researchers concluded. 

This is the fourth major vulnerability to be found in this plugin in the last 
couple of years. These are the best malware removal tools around 

Via: BleepingComputer



======================================================================
Link to news story:
https://www.techradar.com/news/hackers-are-attacking-another-serious-wordpress
-security-flaw-heres-how-to-keep-your-site-safe


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.