Expert Comments

Expert commentary: Black Hat SEO in Danger for Utilization of the Google WordPress Plugin Bug

Expert(s): Security Experts
Expert(s): Security Experts Published: Last Updated on

Following reports from Bleeping Computer, a 300, 000 active installation of dangerous bug has been found in Google’s official WordPress plugin. Attributed to the disclosure of the proxySetupURL within the HTML source code of admin pages, this enables hackers to have owner access to the site’s Google Search Console. Not only that, but “the verification request used to verify a site’s ownership was a registered admin action” fails to have any capability checks. Thus,  such requests can come from any authenticated WordPress user.

 

Experts Comments

Dot Your Expert Comments
Martin Jartelius
May 15, 2020
CSO
Outpost24

It should be patched at the soonest possible.
It should be noted that this vulnerability does require attackers to have a non admin account on the site, and that the “critical” rating is a result of the researchers gauging this as a complete loss of confidentiality. Taking a more modest perspective on that as while sensitive this in no way a complete loss of confidentiality, this is a medium level risk. Of course, it should be patched at the soonest possible, but for many installations it is not exploitable, and for those where it is,.....Read More
It should be noted that this vulnerability does require attackers to have a non admin account on the site, and that the “critical” rating is a result of the researchers gauging this as a complete loss of confidentiality. Taking a more modest perspective on that as while sensitive this in no way a complete loss of confidentiality, this is a medium level risk. Of course, it should be patched at the soonest possible, but for many installations it is not exploitable, and for those where it is, the impact is bad but far from disastrous.  Read Less

Dot Your Expert Comments


Only for registered and approved experts. Please register before providing comments. Register here
* By using this form you agree with the storage and handling of your data by this web site.
Submit
0
FacebookTwitterLinkedinWhatsappEmail

You may also like

Experts Reaction On World Economic Forum 2021 Report Cites Cyber...

Major Security Flaws Found In Signal And other Video Chat...

Comment On IoT Risks Of Peloton Bike

70% of UK Finance Industry Hit With Cyber-Attacks In 2020

A Chinese Hacking Group Is Stealing Airline Passenger Details

Expert Commentary: Hacker Posts 1.9 Million Pixlr User Records For...

NSA And Dutch NCSC Warn Outdated TLS Certs

Federal Agency Warns Cloud Attacks Are On The Rise –...

Experts Reaction On New Chrome Update To Boost Password Security

Experts Insight On Latest Flaw Within DNSpooq