Holes found in most popular WordPress plugins

Powered by SC Magazine
 

Plugins downloaded millions of times.

Updated: Twelve of the most popular WordPress plugins that have been downloaded millions of times contain unpatched vulnerabilities.

Checkmarx researchers reported vulnerabilities in 18 of the top 50 most downloaded plugins which could allow attackers to compromise websites.

But a dozen plugin developers failed to fix their flawed apps despite each pushing out updates in the six months between the first test in which the holes were found and a second test run this month.

Seven of the top 10 most popular e-commerce apps dealing with payments or social media contained vulnerabilities. They had been downloaded 1.7 million times.

The apps contained a host of common vulnerabilities including cross-site scripting, cross-site forgery requests and SQL injection making WordPress sites prime targets for attack by exploit kits.

Security researchers have long flagged the need for WordPress site administrators to be vigilant in searching and fixing security issues.

Aging and since patched vulnerabilities in the TimThumb image resizer plugin has resulted in thousands of compromised websites.  

Web administrators should run vulnerability scans and source code analysis on their sites and plugins.

The Checkmarx report was online. (pdf)

Updated: The company said in a statement it did not disclose the names of the affected plug-ins citing a need to minimise exposure.

Our research of the state of WordPress plug-in was investigative and the publication is meant to raise awareness.

It is not a common practice to expose specific plug-ins that are contaminated – there is a disclosure procedure which we executed with most of the developers – enabling them to fix. 

Obviously public exposure of such plug-ins will make them immediate target for hackers and we try to avoid it. Our message to the public is a precautionary act and we recommend every site owner and developer to conduct certain activities to make sure the plug-ins she / he are using are OK, these steps are listed in the detailed research. 

Copyright © SC Magazine, Australia


Holes found in most popular WordPress plugins
 
 
 
Top Stories
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
How technology will unify Toll
The systems headache formed through 15 years of acquisitions.
 
Immigration breached Privacy Act with data leak
Pilgrim slams "copy and paste" of asylum seeker data.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 836

Vote