Almost a million WordPress websites were vulnerable to a flaw that allowed hackers to modify content on different pages.
As per the report, the websites were vulnerable through a WordPress plugin called Website Builder, developed by SeedProd which has more than 900,000 active installations. The vulnerability involved a missing capability check in one of the plugin’s functions, allowing hackers to modify content on sites such as “coming soon”, maintenance pages, or 404 pages, created using the plugin.
Get top-notch performance, extensive features, and unbeatable value for money. With Hostinger you can enjoy free domain, SSL, backups, and more. Upgrade for professional extras like NVMe storage, CDN, and WordPress caching.
Preferred partner (What does this mean?)
WordPress websites with versions up to 6.15.21 of the plugin installed were vulnerable, the report further stated. SeedProd has addressed it, however, and released a patch bringing the plugin up to version 6.15.22. All WordPress website owners using the plugin are advised to apply the patch immediately.
The vulnerability itself is tracked as CVE-2024-1072, and carries a severity score of 8.2/10 in the Common Vulnerability Scoring System (CVSS), making it a “high risk” flaw.
WordPress is by far the world’s most popular website builder, powering almost half (43%) of all websites on the internet. This also makes it an extremely popular target among hackers. However, WordPress is generally considered safe, as less than 1% of all known vulnerabilities on the platform target the website builder itself.
Instead, hackers usually look for flaws in plugins and addons, as many of them aren’t as thoroughly monitored, or frequently updated, as they should be. This rings particularly true for non-commercial plugins, which are often built by a single developer, and sometimes abandoned, but still widely used. Administrators are advised to always keep all of their plugins updated.
More from TechRadar Pro
This top WordPress plugin has a major security flaw - and there's no fix yet
Here's a list of the best firewalls around today
These are the best endpoint security tools right now
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.