{"id":624340,"date":"2023-04-01T09:49:13","date_gmt":"2023-04-01T14:49:13","guid":{"rendered":"https:\/\/news.sellorbuyhomefast.com\/index.php\/2023\/04\/01\/hackers-exploit-wordpress-plugin-flaw-that-gives-full-control-of-millions-of-sites\/"},"modified":"2023-04-01T09:49:13","modified_gmt":"2023-04-01T14:49:13","slug":"hackers-exploit-wordpress-plugin-flaw-that-gives-full-control-of-millions-of-sites","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2023\/04\/01\/hackers-exploit-wordpress-plugin-flaw-that-gives-full-control-of-millions-of-sites\/","title":{"rendered":"Hackers exploit WordPress plugin flaw that gives full control of millions of sites"},"content":{"rendered":"
\n

\n GOT UPDATES? \u2014
\n<\/h4>\n

Elementor Pro fixed the vulnerability, but not everyone has installed the patch.<\/h2>\n
\n

\n Dan Goodin<\/span><\/a>
\n –

\n
\n \"Hackers
\n

Getty Images<\/p>\n<\/figcaption><\/figure>\n

Hackers are actively exploiting a critical vulnerability in a widely used WordPress plugin that gives them the ability to take complete control of millions of sites, researchers said.<\/p>\n

The vulnerability, which carries a severity rating of 8.8 out of a possible 10, is present in Elementor Pro, a premium plugin<\/a> running on more than 12 million sites powered by the WordPress content management system. Elementor Pro allows users to create high-quality websites using a wide range of tools, one of which is WooCommerce, a separate WordPress plugin. When those conditions are met, anyone with an account on the site\u2014say a subscriber or customer\u2014can create new accounts that have full administrator privileges.<\/p>\n

The vulnerability was discovered by Jerome Bruandet, a researcher with security firm NinTechNet. Last week, Elementor, the developer of the Elementor Pro plugin, released<\/a> version 3.11.7, which patched the flaw. In a post<\/a> published on Tuesday, Bruandet wrote:<\/p>\n

\n

An authenticated attacker can leverage the vulnerability to create an administrator account by enabling registration (users_can_register<\/code>) and setting the default role (default_role<\/code>) to \u201cadministrator\u201d, change the administrator email address (admin_email<\/code>) or, as shown below, redirect all traffic to an external malicious website by changing siteurl<\/code> among many other possibilities:<\/p>\n

MariaDB [example]> SELECT * FROM `wp_options` WHERE `option_name`='siteurl';\n+-----------+-------------+------------------+----------+\n| option_id | option_name | option_value     | autoload |\n+-----------+-------------+------------------+----------+\n|\t\t 1 | siteurl     | https:\/\/evil.com | yes \t |\n+-----------+-------------+------------------+----------+\n1 row in set (0.001 sec)<\/pre>\n<\/blockquote>\n
Now, researchers with a separate security firm, PatchStack, report<\/a> that the vulnerability is under active exploitation. Attacks are coming from a variety of IP addresses, including:<\/p>\n