Menu
Attackers exploit zero-day flaw in popular WordPress plug-in

Attackers exploit zero-day flaw in popular WordPress plug-in

Users should install newly released security patches or remove the affected plug-in

WordPress sites with the plug-in Fancybox-for-WordPress should apply a critical security update released Thursday that fixes a vulnerability already exploited by attackers.

Researchers from Web security firm Sucuri issued a warning about the vulnerability Wednesday after seeing attacks that injected a malicious iframe into websites.

They tracked down the problem to a flaw in Fancybox-for-WordPress, which allows webmasters to easily integrate the Fancybox JavaScript library into their WordPress sites. FancyBox is a tool for displaying images, HTML content and multimedia in a so-called "lightbox" that floats on top of Web pages.

Fancybox-for-WordPress has been downloaded almost 600,000 times from the official WordPress plug-in repository to date.

"After some analysis, we can confirm that this plugin has a serious vulnerability that allows for malware (or any random script/content) to be added to the vulnerable site," the Sucuri researchers said in a blog post in which they advised users to remove the plug-in because the flaw was unpatched.

That might no longer be necessary as the plug-in's developers released two new versions in rapid succession Thursday to fix the vulnerability. Version 3.0.3 addresses the actual flaw, while version 3.0.4 renames the plug-in setting where the issue originated.

"This should stop the malicious code from appearing on sites where the plugin is updated without removing the malicious code," the plug-in developers said in the changelog.

Users are advised to update to the latest version -- 3.0.4.

WordPress sites are a favorite target for hackers, who compromise them to host malicious content and spam pages or to try and gain control of the underlying Web servers. Vulnerabilities in WordPress plug-ins and themes have been exploited before in large scale attacks that compromised thousands of websites.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags online safetyintrusionpatchesExploits / vulnerabilitiesSucuri

Featured

Slideshows

Reseller News Platinum Club celebrates leading partners in 2019

Reseller News Platinum Club celebrates leading partners in 2019

The leading players of the New Zealand channel came together to celebrate a year of achievement at the annual Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months.

Reseller News Platinum Club celebrates leading partners in 2019
Reseller News hosts alumnae breakfast for Women in ICT Awards

Reseller News hosts alumnae breakfast for Women in ICT Awards

Reseller News hosted its second annual alumnae breakfast for the Women in ICT Awards in New Zealand, designed to showcase the leading female leaders in the industry. Held at The Cordis in Auckland, attendees came together to hear inspiring keynotes and panel discussions, alongside high-level networking among peers. Photos by Gino Demeer.

Reseller News hosts alumnae breakfast for Women in ICT Awards
Reseller News Innovation Awards 2019: meet the winners

Reseller News Innovation Awards 2019: meet the winners

Reseller News honoured the standout players of the New Zealand channel in front of more than 480 technology leaders in Auckland on 23 October, recognising the achievements of top partners, emerging entrants and innovative start-ups.

Reseller News Innovation Awards 2019: meet the winners
Show Comments