Insecure WordPress plugin exposes thousands of sites to takeover attacks

data privacy
(Image credit: Shutterstock / Zeeker2526)
Audio player loading…

Researchers have disclosed a series of vulnerabilities that could have exposed thousands of WordPress (opens in new tab) websites to takeover attacks.

According to a blog post (opens in new tab) from security firm Wordfence, the bugs were present in Brizy - Page Builder, a WordPress plugin (opens in new tab) installed across more than 90,000 sites. Although a fix has now been released, it’s likely a number of installations remain unpatched.

If exploited, one chain of vulnerabilities could reportedly allow attackers to execute “complete site takeover” and add malicious JavaScript to existing posts. Separately, another of the vulnerabilities could be exploited to upload executable files and achieve remote code execution.

As per the Common Vulnerability Scoring System (CVSS), the Brizy - Page Builder bugs range in severity from medium (6.4) to high (8.8).

WordPress plugin vulnerability

he researchers were first alerted to a potential problem when they observed unusual traffic relating to the Brizy - Page Builder plugin. Although the plugin was not under active attack, the group was able to identify a selection of interconnected bugs.

“[The unusual traffic] led us to discover two new vulnerabilities as well as a previously patched access control vulnerability in the plugin that had been reintroduced,” Wordfence explained. “Both new vulnerabilities could take advantage of the access control vulnerability to allow complete site takeover.”

The nature of these vulnerabilities was such that any registered user (including subscribers) could pass for an administrator and modify posts and pages, even if they had already been published to the site.

The issues were identified by Wordfence in early June. After a full investigation was conducted, the researchers notified the vendor of the vulnerabilities in mid-August and a full patch was released roughly a week later.

To shield against attack, WordPress users are advised to update to the latest version of the Brizy - Page Builder plugin (version 2.3.17) immediately.

Joel Khalili
News and Features Editor

Joel Khalili is the News and Features Editor at TechRadar Pro, covering cybersecurity, data privacy, cloud, AI, blockchain, internet infrastructure, 5G, data storage and computing. He's responsible for curating our news content, as well as commissioning and producing features on the technologies that are transforming the way the world does business.