Major WordPress Zero-Day Uncovered

In a new blog post, researchers from Imperva discuss a zero-day vulnerability in WordPress core that was just disclosed. The vulnerability allows an attacker to perform a denial of service (DoS) attack against a vulnerable application and exists in the modules used to load JS and CSS files. These modules were designed to decrease page-loading time, but have effectively rendered the WordPress core susceptible to DoS attacks. WordPress holds a market share of more than 29 percent of internet websites and 60 percent of content management systems (CMS) worldwide, turning any vulnerability in the WordPress core into a potentially large-scale exploit. Ben Herzberg, Head of Threat Research at Imperva commented below.

Ben Herzberg, Head of Threat Research at Imperva:

“This new vulnerability effectively renders the WordPress core susceptible to DoS attacks. Due to its simplicity, a low skill attacker can utilize the existing public exploit to take down any unprotected WordPress site. This is extremely serious considering 29 percent of websites and 60 percent of CMS worldwide are WordPress based. WordPress sites can protect against the attack by restricting access to the vulnerable resources, or capping the rate in which their clients can access these resources.”