Millions of WordPress sites hit in wide-ranging attack

WordPress logo
(Image credit: Pixabay)
Audio player loading…

A WordPress (opens in new tab) vulnerability present across millions of sites is being targeted by threat actors, according to security researchers. A number of the security bugs have only recently been patched, leaving a huge number of sites at risk.

The security flaw in question affects WordPress sites with Epsilon Framework themes installed. 

Wordfence, the WordPress security plugin provider that discovered the recent attacks, has not revealed much information about the exploit as it does not seem to have reached a mature stage of development.

“On November 17, 2020, our Threat Intelligence team noticed a large-scale wave of attacks against recently reported Function Injection vulnerabilities in themes using the Epsilon Framework, which we estimate are installed on over 150,000 sites,” Ram Gall, a Wordfence QA engineer and threat analyst, explained (opens in new tab). “So far today, we have seen a surge of more than 7.5 million attacks against more than 1.5 million sites targeting these vulnerabilities, coming from over 18,000 IP addresses.”

Vulnerable themes

According to Wordfence (opens in new tab), the following versions of the Epsilon Framework themes continue to be at risk:

  • Shapely <=1.2.7
  • NewsMag <=2.4.1
  • Activello <=1.4.0
  • Illdy <=2.1.4
  • Allegiant <=1.2.2
  • Newspaper X <=1.3.1
  • Pixova Lite <=2.0.5
  • Brilliance <=1.2.7
  • MedZone Lite <=1.2.4
  • Regina Lite <=2.0.4
  • Transcend <=1.1.8
  • Affluent <1.1.0
  • Bonkers <=1.0.4
  • Antreas <=1.0.2
  • NatureMag Lite <=1.0.5

It appears that the majority of attacks are simply probing for further vulnerabilities, although a remote code execution exploit is possible that would allow an attacker to take over a compromised site.

If an individual’s website is running one of the vulnerable themes, it is essential that they update to a patched version if available. If not, it is probably best to temporarily switch to another theme. Alternatively, adopting a WordPress firewall plugin should offer protection.

Via BleepingComputer (opens in new tab)

Barclay has been writing about technology for a decade, starting out as a freelancer with ITProPortal covering everything from London’s start-up scene to comparisons of the best cloud storage services.  After that, he spent some time as the managing editor of an online outlet focusing on cloud computing, furthering his interest in virtualization, Big Data, and the Internet of Things.