Of these vulnerabilities, one is tracked as critical with a CVSS score of 9.9, another is tracked as high with a score of 8.8 and the third vulnerability is tracked as medium with a score of 5.4.
The first flaw makes it possible for an authenticated attacker with low-level permissions to upload arbitrary files to achieve remote code execution (opens in new tab) while the other two flaws allow an attacker to forge requests to modify the plugin's settings and upload arbitrary files that could lead to remote code execution.
- We've built a list of the best WordPress themes (opens in new tab) available
- These are the best website builders (opens in new tab) on the market
- Also check out our roundup of the best free website builder (opens in new tab)
If an attacker managed to exploit these flaws on a WordPress site running a vulnerable version of the plugin, they could take over the site which could have consequences including backdoors, spam injections, malicious redirects and other malicious activities, according to a new report (opens in new tab) from Wordfence's Chloe Chamberland.
Vulnerable WordPress sites
After discovering these three vulnerabilities, Wordfence initially tried to reach out Responsive Menu's parent company ExpressTech but received no response. From there, the researchers tried to contact the creators of the plugin on their site but once again received no response. Finally, Wordfence got in touch with the WordPress Plugins team who were able to establish contact between the company and Responsive Menu.
Wordfence and Responsive Menu worked to resolve the plugin's issues and a patch was released in mid-January. As all three flaws are quite serious, users of the plugin should update to the latest patched version (4.04 (opens in new tab)).
However, at the time of writing, 65 percent of users are still running vulnerable versions of Responsive Menu according to data from its page (opens in new tab) on WordPress.org. In fact, just over 50,000 new downloads have been recorded which means that another 50,000 sites are still vulnerable to site takeover attacks.
If your WordPress site is running the Responsive Menu plugin, you should download and install version 4.04 immediately to prevent falling victim to any potential attacks.
- We've also highlighted the best web hosting (opens in new tab)
Via BleepingComputer (opens in new tab)