WooCommerce Patches Critical Plugin Flaw Affecting Half a Million Sites

Susceptible code has been discovered in the payment answer plugin WooCommerce for the WordPress information administration program (CMS) that could permit an unauthenticated attacker to attain administrative privileges and choose over a web page.

The conclusions appear from WordPress security gurus at Wordfence, who explained the critical authentication bypass in a blog site submit printed on Thursday.

Examine additional on WordPress plugin vulnerabilities here: Significant Severity WordPress Plugin Bug Hits A few Million

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The Wordfence site write-up, prepared by senior menace researcher Ram Gall, explains how the staff located the vulnerability just after analyzing model 5.6.2 of the WooCommerce plugin on the identical day it was launched.

“After reviewing the update, we decided that it taken off susceptible code that could make it possible for an unauthenticated attacker to impersonate an administrator and fully consider more than a site without having any consumer conversation or social engineering needed,” Gall wrote.

The researcher also clarified that the changelog entry for the 5.6.2 plugin only confirmed “Security update” with no mentioning particulars of the critical flaw it patched.

“Regardless of the edition of Wordfence you are applying, we urge you to update to the most up-to-date model of the WooCommerce Payments plugin, which is 5.6.2 as of this crafting, straight away,” Gall warned. “WooCommerce Payments is installed on in excess of 500,000 web sites, and this is a critical-severity vulnerability.

Gall also clarified that the Wordfence team is not mindful of no matter if this flaw was discovered internally by Automattic (the developer driving WooCommerce) or reported by an exterior researcher. Wordfence has not still observed instances of the vulnerability staying exploited in the wild, but that may change in the in close proximity to upcoming.

“We anticipate to see significant-scale attacks focusing on this vulnerability when a evidence of concept gets to be accessible to attackers,” Gall included.

The flaw will come months soon after Sucuri security researchers noticed a malware marketing campaign created to improve the lookup engine rankings of about 15,000 spam WordPress and other web sites.