Categories: Wordpress

Ten WordPress Plugins For WooCommerce Expose E-Commerce Stores to a Range of Attacks

Serious security flaws identified in ten WordPress Plugins could be exploited by hackers to upload keyloggers, shells, crypto miners and other malicious software or completely deface the website.

All the plugins are developed by MULTIDOTS Inc to work only with WooCommerce (WordPress eCommerce Platform). The plugins vulnerability puts a number of Store Owners at risk.

Researchers from threatpress identified the ten WordPress Plugins and reported to MULTIDOTS Inc, but the vendor failed to patch the plugins.

So it has been reported by threatpress o the WordPress plugin repository security team and the plugins are taken down from the store on May 23, 2018. According to the WordPress plugin repository, over 19,400 active installs of these ten Vulnerable WordPress Plugins.

As there is too many up’s and down’s in WordPress usage, it requires a security consideration, so the WordPress Penetration testing is essential to find the vulnerabilities and to secure your WordPress powered blog.

Ten WordPress Plugins

WooCommerce Category Banner Management – Unauthenticated Settings Change
Add Social Share Messenger Buttons Whatsapp and Viber – Cross-site Request Forgery
Advanced Search for WooCommerce – Stored Cross-site scripting (XSS)
Eu Cookie Notice – Cross-site request forgery (CSRF)
Mass Pages/Posts Creator – Authenticated Stored Cross-Site Scripting (XSS)
Page Visit Counter – SQL Injection
WooCommerce Checkout For Digital Goods – Cross-site request forgery (CSRF)
WooCommerce Enhanced E-commerce Analytics Integration with Conversion Tracking – Cross-site request forgery (CSRF) and Stored Cross-site scripting (XSS)
WooCommerce Product Attachment – Authenticated stored Cross-site scripting (XSS)
Woo Quick Reports – Stored Cross-Site Scripting (XSS)

“The author (MULTIDOTS Inc.) failed to fix the problem within a period of 3 weeks. It’s good to know that WordPress Security reacts quickly, but still, we have a big problem.” Threatpress published blog PoC for all the vulnerabilities.

These vulnerabilities tracked as CVE-2018-11579, CVE-2018-11580, CVE-2018-11633 and CVE-2018-11632 and still, the vulnerabilities are not patched.

“We hope to see some changes in this area. In this case, we could notify owners of affected websites and secure almost twenty thousand websites.”

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

1 day ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

3 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago