Zum Inhalt der Seite gehen
Critical WordPress Anti-Spam Plugin Flaws expose 200k+ Sites to Remote Attacks

Two critical security flaws impacting the Spam protection, Anti-Spam & FireWall plugin WordPress could allow an unauthenticated attacker to install & enable malicious plugins on susceptible sites.

https://www.wordfence.com/blog/2024/11/200000-wordpress-sites-affected-by-unauthenticated-critical-vulnerabilities-in-anti-spam-by-cleantalk-wordpress-plugin/

#wordpress #it #security #privacy #engineer #media #tech #news
The vulnerabilities, tracked as CVE-2024-10542 and CVE-2024-10781, carry a CVSS score of 9.8 out of a maximum of 10.0. They were addressed in versions 6.44 and 6.45. According to Wordfence, both vulnerabilities concern an authorization bypass issue that could allow a malicious actor to install and activate arbitrary plugins. This could then pave the way for remote code execution if the activated plugin is vulnerable of its own. The plugin is "vulnerable to unauthorized Arbitrary Plugin Installation due to a missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44," security researcher István Márton said, referring to CVE-2024-10781. On the other hand, CVE-2024-10542 stems from an authorization bypass via reverse DNS spoofing on the checkWithoutToken() function. Regardless of the bypass method, successful exploitation of the two shortcomings could allow an attacker to install, activate, deactivate or even uninstall plugins. <⚠️Users of the plugin are advised to ensure that their sites are updated to the latest patched version to safeguard against potential threats.⚠️>
#news #privacy #tech #wordpress #media #security #it #engineer
⇧