A zero-day vulnerability in an ecommerce plugin for WordPress has been exploited by cybercriminals to upload backdoors to affected websites, researchers warned.
The ideal scenario for profit-driven hackers is to find and exploit security holes in plugins installed on hundreds of thousands or millions of websites. However, targeting a large number of less popular applications can also be profitable.
A good example is WP Marketplace, a WordPress shopping cart/e-commerce plugin installed on less than 500 websites. WP Marketplace is no longer maintained, which means that vulnerabilities are unlikely to ever get patched.
Last week, researchers at White Fir Design started seeing requests for a file associated with WP Marketplace. They quickly determined that attackers were most likely trying to find websites running WP Marketplace in an effort to exploit an arbitrary file upload vulnerability.
Sucuri has also observed attack attempts in the wild. According to the security firm, cybercriminals have been exploiting the vulnerability to upload a commonly used backdoor.
“Of course, it is not as valuable for hackers as vulnerabilities in popular plugins installed on every other site, but if your toolkit comprises hundreds of smaller vulnerabilities, the success rate will be comparable,” said Sucuri’s Denis Sinegubko. “That’s why plugin developers shouldn’t neglect best security practices even when developing small plugins.”
WP Marketplace, which hasn’t been updated in the last 8 months, was removed last week from the official WordPress Plugin Directory. White Fir Design pointed out that its developers also offer several other plugins, including WordPress Download Manager, which has tens of thousands of active installs. However, security doesn’t appear to be a priority. A file upload flaw discovered by White Fir Design nearly four months ago in the WordPress Download Manager is still unpatched.
Ecommerce websites are increasingly targeted by cybercriminals. Experts recently discovered thousands of compromised online shops set up to steal users’ payment card information.
Related Reading: WordPress Flaw Allows XSS Attack via Image Filenames
Related Reading: Persistent XSS Patched in WooCommerce WordPress Plugin
Related Reading: Persistent XSS Flaws Patched in Popular WordPress Plugins
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
Latest News
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
- Comcast Wants a Slice of the Enterprise Cybersecurity Business
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- New York Attorney General Fines Vendor for Illegally Promoting Spyware
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder
- Cyber Insights 2023 | Zero Trust and Identity and Access Management
- Cyber Insights 2023 | The Coming of Web3
