A WordPress (opens in new tab) vulnerability present across millions of sites is being targeted by threat actors, according to security researchers. A number of the security bugs have only recently been patched, leaving a huge number of sites at risk.
The security flaw in question affects WordPress sites with Epsilon Framework themes installed.
Wordfence, the WordPress security plugin provider that discovered the recent attacks, has not revealed much information about the exploit as it does not seem to have reached a mature stage of development.
- Here are the best web hosting providers (opens in new tab)
- We've put together a list of the best WordPress themes (opens in new tab) around
- These are the best premium WordPress themes (opens in new tab)
“On November 17, 2020, our Threat Intelligence team noticed a large-scale wave of attacks against recently reported Function Injection vulnerabilities in themes using the Epsilon Framework, which we estimate are installed on over 150,000 sites,” Ram Gall, a Wordfence QA engineer and threat analyst, explained (opens in new tab). “So far today, we have seen a surge of more than 7.5 million attacks against more than 1.5 million sites targeting these vulnerabilities, coming from over 18,000 IP addresses.”
According to Wordfence (opens in new tab), the following versions of the Epsilon Framework themes continue to be at risk:
- Shapely <=1.2.7
- NewsMag <=2.4.1
- Activello <=1.4.0
- Illdy <=2.1.4
- Allegiant <=1.2.2
- Newspaper X <=1.3.1
- Pixova Lite <=2.0.5
- Brilliance <=1.2.7
- MedZone Lite <=1.2.4
- Regina Lite <=2.0.4
- Transcend <=1.1.8
- Affluent <1.1.0
- Bonkers <=1.0.4
- Antreas <=1.0.2
- NatureMag Lite <=1.0.5
It appears that the majority of attacks are simply probing for further vulnerabilities, although a remote code execution exploit is possible that would allow an attacker to take over a compromised site.
If an individual’s website is running one of the vulnerable themes, it is essential that they update to a patched version if available. If not, it is probably best to temporarily switch to another theme. Alternatively, adopting a WordPress firewall plugin should offer protection.
- We've also highlighted the best antivirus tools (opens in new tab) around
Via BleepingComputer (opens in new tab)