A zero-day vulnerability in an ecommerce plugin for WordPress has been exploited by cybercriminals to upload backdoors to affected websites, researchers warned.
The ideal scenario for profit-driven hackers is to find and exploit security holes in plugins installed on hundreds of thousands or millions of websites. However, targeting a large number of less popular applications can also be profitable.
A good example is WP Marketplace, a WordPress shopping cart/e-commerce plugin installed on less than 500 websites. WP Marketplace is no longer maintained, which means that vulnerabilities are unlikely to ever get patched.
Last week, researchers at White Fir Design started seeing requests for a file associated with WP Marketplace. They quickly determined that attackers were most likely trying to find websites running WP Marketplace in an effort to exploit an arbitrary file upload vulnerability.
Sucuri has also observed attack attempts in the wild. According to the security firm, cybercriminals have been exploiting the vulnerability to upload a commonly used backdoor.
“Of course, it is not as valuable for hackers as vulnerabilities in popular plugins installed on every other site, but if your toolkit comprises hundreds of smaller vulnerabilities, the success rate will be comparable,” said Sucuri’s Denis Sinegubko. “That’s why plugin developers shouldn’t neglect best security practices even when developing small plugins.”
WP Marketplace, which hasn’t been updated in the last 8 months, was removed last week from the official WordPress Plugin Directory. White Fir Design pointed out that its developers also offer several other plugins, including WordPress Download Manager, which has tens of thousands of active installs. However, security doesn’t appear to be a priority. A file upload flaw discovered by White Fir Design nearly four months ago in the WordPress Download Manager is still unpatched.
Ecommerce websites are increasingly targeted by cybercriminals. Experts recently discovered thousands of compromised online shops set up to steal users’ payment card information.
Related Reading: WordPress Flaw Allows XSS Attack via Image Filenames
Related Reading: Persistent XSS Patched in WooCommerce WordPress Plugin
Related Reading: Persistent XSS Flaws Patched in Popular WordPress Plugins
