Number: IRCNE2014072240
Date: 2014-07-05
According to “computerworld”, a critical vulnerability found in a WordPress plug-in that has been downloaded over 1.7 million times allows potential attackers to take complete control of blogs that use it.
The flaw is located in the MailPoet Newsletters plug-in, previously known as wysija-newsletters, and was discovered by researchers from Web security firm Sucuri.
"This bug should be taken seriously; it gives a potential intruder the power to do anything he wants on his victim's website," Daniel Cid, Sucuri's chief technology officer, said in a blog post Tuesday. "It allows for any PHP file to be uploaded. This can allow an attacker to use your website for phishing lures, sending SPAM, hosting malware, infecting other customers (on a shared server), and so on!"
The vulnerability was patched in MailPoet version 2.6.7, released Tuesday, so all WordPress blog administrators should upgrade the plug-in to the latest version as soon as possible if they use it.
- 2