A new WordPress plug-in exploit endangers thousands of websites

Over the past few days, attackers have been exploiting an unpatched vulnerability in WP Mobile Detector, a WordPress plug-in installed on over 10,000 websites.

The plug-in’s developer fixed the flaw Tuesday in version 3.6, but in addition to updating immediately, users should also check if their websites haven’t already been hacked.

The vulnerability is located in a script called resize.php script and allows remote attackers to upload arbitrary files to the Web server. These files can be backdoor scripts known as Web shells that provide attackers with backdoor access to the server and the ability to inject code into legitimate pages.

The flaw was discovered by WordPress security outfit PluginVulnerabilities.com after it observed requests for the wp-content/plugins/wp-mobile-detector/resize.php even though it didn’t exist on its server. This indicated that someone was running an automated scan for that specific file, likely because it had a flaw.

To read this article in full or to leave a comment, please click here