Holes found in most popular WordPress plugins

Powered by SC Magazine
 

Plugins downloaded millions of times.

Updated: Twelve of the most popular WordPress plugins that have been downloaded millions of times contain unpatched vulnerabilities.

Checkmarx researchers reported vulnerabilities in 18 of the top 50 most downloaded plugins which could allow attackers to compromise websites.

But a dozen plugin developers failed to fix their flawed apps despite each pushing out updates in the six months between the first test in which the holes were found and a second test run this month.

Seven of the top 10 most popular e-commerce apps dealing with payments or social media contained vulnerabilities. They had been downloaded 1.7 million times.

The apps contained a host of common vulnerabilities including cross-site scripting, cross-site forgery requests and SQL injection making WordPress sites prime targets for attack by exploit kits.

Security researchers have long flagged the need for WordPress site administrators to be vigilant in searching and fixing security issues.

Aging and since patched vulnerabilities in the TimThumb image resizer plugin has resulted in thousands of compromised websites.  

Web administrators should run vulnerability scans and source code analysis on their sites and plugins.

The Checkmarx report was online. (pdf)

Updated: The company said in a statement it did not disclose the names of the affected plug-ins citing a need to minimise exposure.

Our research of the state of WordPress plug-in was investigative and the publication is meant to raise awareness.

It is not a common practice to expose specific plug-ins that are contaminated – there is a disclosure procedure which we executed with most of the developers – enabling them to fix. 

Obviously public exposure of such plug-ins will make them immediate target for hackers and we try to avoid it. Our message to the public is a precautionary act and we recommend every site owner and developer to conduct certain activities to make sure the plug-ins she / he are using are OK, these steps are listed in the detailed research. 

Copyright © SC Magazine, Australia


Holes found in most popular WordPress plugins
 
 
 
Top Stories
First look: Microsoft Outlook for iOS
[Update] Office productivity suite for iOS completed with Outlook.
 
NewSat defaults on $26m in overdue Lockheed payments
Jabiru-1 satellite build hits further hurdles.
 
IBM denies plans to cut 112k jobs
But admits to further restructuring.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3085

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 982

Vote