Vulnerable WordPress plugin opens door to millions of attacks

Unbreakable Lock
(Image credit: KAUST)

Security researchers have shared details about a large-scale attack campaign targeting a set of critical vulnerabilities in The Plus addons for the popular Elementor Pro WordPress website builder

Web hosting company Seravo first reported the zero-day vulnerabilities in the third-party WordPress plugins, which were already being exploited. Using the exploit, malicious users are able to log in as administrator or create new administrative accounts on any affected site.

The privilege escalation vulnerabilities in the addons are being tracked by Wordfence, which develops a WordPress security plugin of the same name. While analyzing the plugin, the Wordfence security researchers found additional vulnerabilities and notified the developer.

TechRadar needs yo...

We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.

>> Click here to start the survey in a new window<<

Although the vulnerabilities have already been patched, according to Wordfence there has been no let-up in the attacks.

Unusual campaign

Over the past ten days, Wordfence claims to have blocked over 14 million attacks that hunt for websites using unpatched versions of the vulnerable addons. 

This is surprising because the addons are used on only about 30,000 websites, of which nearly 60% are thought to have upgraded to the patched version. 

“This campaign is notable in that it is targeting a recent vulnerability and, therefore, has a higher chance of success than the other campaigns we’ve seen recently," said Wordfence.

"It is also unusual in that it is a set of sustained attacks, whereas attack spikes we’ve seen in the past have typically only lasted a few days before subsiding."

To shield against attack, affected WordPress users are advised to install the relevant patches immediately.

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.