Menu
Critical vulnerability in popular WordPress newsletter plug-in endangers many blogs

Critical vulnerability in popular WordPress newsletter plug-in endangers many blogs

Attackers could exploit a flaw in the MailPoet Newsletters plug-in to take full control of vulnerable blogs, researchers from Sucuri said

A critical vulnerability found in a WordPress plug-in that has been downloaded over 1.7 million times allows potential attackers to take complete control of blogs that use it.

The flaw is located in the MailPoet Newsletters plug-in, previously known as wysija-newsletters, and was discovered by researchers from Web security firm Sucuri.

"This bug should be taken seriously; it gives a potential intruder the power to do anything he wants on his victim's website," Daniel Cid, Sucuri's chief technology officer, said in a blog post Tuesday. "It allows for any PHP file to be uploaded. This can allow an attacker to use your website for phishing lures, sending SPAM, hosting malware, infecting other customers (on a shared server), and so on!"

The vulnerability was patched in MailPoet version 2.6.7, released Tuesday, so all WordPress blog administrators should upgrade the plug-in to the latest version as soon as possible if they use it.

The flaw was the result of the MailPoet developers wrongly assuming that the "admin_init" hook in WordPress is only triggered when an administrator visits pages from the administration panel, Cid said.

The MailPoet developers used admin_init to verify whether the active user is allowed to upload files, but since this hook is actually also triggered by a page accessible to unauthenticated users, the plug-in's file upload functionality was made available to virtually anyone.

It's easy to make this mistake and all plug-in developers should be mindful of this behavior, Cid said. "If you are a developer, never use admin_init() or is_admin() as an authentication method."

WordPress sites are a constant target for attackers and those that get compromised are frequently used to host spam pages or malicious content as part of other attacks. Cybercriminals are running scans on the Internet every day to identify WordPress installations affected by vulnerabilities like the one found in MailPoet.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchessecurityAccess control and authenticationpatch managementSucuriExploits / vulnerabilities

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments