Thousands of WordPress sites hit by gift card plugin flaw

Thousands of WordPress websites were found using a vulnerability add-on that allows threat actors to take over the site entirely. 

Researchers uncovered a critical flaw in YITH WooCommerce Gift Cards Premium, an add-on for the website builder providing an interface to build gift cards on WordPress sites, which is reportedly being used by more than 50,000 websites.

The flaw itself is an unauthenticated arbitrary file upload vulnerability, allowing crooks, among other things, to upload web shells and gain full access to the target website.

Stealing crypto account details

The vulnerability, tracked as CVE-2022-45359 and given has a severity score of 9.8 – critical, has since been patched and users are urged to update their add-on as soon as possible, as there is evidence of the flaw being abused in the wild.

It was first discovered in late November 2022, when researchers found the flaw present in all versions up to 3.19.0. Hence, users are advised to bring the add-on to at least 3.20.0, or 3.21.0 which is now also available for download. 

The flaw was discovered by Wordfence, a cybersecurity company analyzing the WordPress ecosystem, and its researchers claim there are threat actors leveraging the flaw out there, already. 

While most attacks took place in November, while the flaw was still considered a zero-day, another peak in usage was also observed on December 14, 2022. 

Just two IP addresses (103.138.108.15, and 188.66.0.135) accounted for more than 20,000 exploitation attempts against almost 12,000 websites. 

While WordPress itself is relatively stable (around 0.5% of all WordPress-related vulnerabilities fall on the web hosting platform itself), its ecosystem is large and as such, provides ample opportunities for exploitation. Paid add-ons, such as this one, are usually frequently updated and developers try to maintain a secure product, while free add-ons can often go for months without patches and can turn into a real nightmare for webmasters.

Via: BleepingComputer (opens in new tab)