Online Services

eWorldLinx

Tag: WordPress Plugins

  • Formidable Forms / Shortcodes Ultimate Exploits In The Wild

    Formidable Forms / Shortcodes Ultimate Exploits In The Wild

    Formidable Forms / Shortcodes Ultimate Exploits In The Wild

    On Monday, November 20th, we were notified about a vulnerability that poses a serious security risk when the Shortcodes Ultimate and Formidable Forms plugins are used together on a single WordPress installation.

    Over the past couple of weeks, we’ve noticed a large influx in the number of malicious requests testing for the presence of the two popular WordPress plugins. Both of these plugins contain separate medium-risk vulnerabilities that, when combined, allow an attacker to remotely execute rogue code on the underlying server.

    Continue reading Formidable Forms / Shortcodes Ultimate Exploits In The Wild at Sucuri Blog.

  • SQL Injection in bbPress

    SQL Injection in bbPress

    SQL Injection in bbPress

    During regular audits of our Sucuri Firewall (WAF), one of our researchers at the time, Slavco Mihajloski, discovered an SQL Injection vulnerability affecting bbPress. If the proper conditions are met, this vulnerability is very easy to abuse by any visitors on the victim’s website.

    Because details about this vulnerability have been made public today on a Hackerone report, and updating to the latest version of WordPress fixes the root cause of the problem, we chose to disclose this bug and make the details public.

    Continue reading SQL Injection in bbPress at Sucuri Blog.

  • New WordPress Security Guide

    New WordPress Security Guide

    New WordPress Security Guide

    WordPress has become the most popular CMS and now powers over 28% of the web. With over 60 million downloads, its popularity makes it a prime target for malicious hackers that are looking for vulnerabilities to exploit. If an attacker is able to gain unauthorized access into an insecure website, they can leverage valuable resources for malware or spam campaigns, harming a website’s visitors and reputation.

    Our new guide is intended to educate WordPress administrators on basic security techniques and steps to help improve your security posture.

    Continue reading New WordPress Security Guide at Sucuri Blog.

  • Fake Plugins, Fake Security

    Fake Plugins, Fake Security

    Fake Plugins, Fake Security

    WordPress users are becoming increasingly more aware of security threats and as a result they are taking more actions to secure their websites (e.g. by installing security plugins). While this is a good thing, there are always black hats trying to take an advantage of new opportunities to compromise websites. For example, we’re seeing a rising number of fake plugins claiming to offer security, when in reality they have malicious intentions.

    Recently, a fake WordPress security plugin called X-WP-SPAM-SHIELD-PRO got our attention.

    Continue reading Fake Plugins, Fake Security at Sucuri Blog.