Hackers Exploit Unpatched Bug In Rich Reviews WordPress Plugin – Comments

By   ISBuzz Team
Writer , Information Security Buzz | Sep 26, 2019 06:28 am PST

Hackers are currently exploiting an unpatched vulnerability in the Rich Reviews WordPress plugin for malvertising campaigns. Although the plugin was removed for security reasons from the WordPress repository more than six months ago, it is estimated that 16,000 websites still have it running. The two issues allowing the attack are a lack of access controls for changing the plugin’s options and not sanitizing the values of the options.

Notify of
1 Expert Comment
Oldest Most Voted
Inline Feedbacks
View all comments
Amir Shaked
Amir Shaked , VP, R&D
September 26, 2019 2:30 pm

WordPress is among the world’s most hacked content management systems. This fact is well known. What is sometimes less well known is that server-side threats like cross-site scripting (XSS) result in client-side code vulnerabilities. Traditional server-side protections do not address client-side vulnerabilities. This is because websites are assembled using code from third-party libraries and partners, and the related user traffic is handled directly by the third-party domains, making it difficult for website owners to get visibility into potentially malicious code changes. In fact, a recent survey we ran found that only 11% of website decision makers believe they have complete insight into the third-party scripts on their website, yet industry estimates state that up to 70% of code on a website is third-party. Website owners need to remain vigilant to both the server-side and the client-side threats inherent in WordPress.

Last edited 4 years ago by Amir Shaked

Recent Posts

Would love your thoughts, please comment.x