Holes found in most popular WordPress plugins

Powered by SC Magazine
 

Plugins downloaded millions of times.

Updated: Twelve of the most popular WordPress plugins that have been downloaded millions of times contain unpatched vulnerabilities.

Checkmarx researchers reported vulnerabilities in 18 of the top 50 most downloaded plugins which could allow attackers to compromise websites.

But a dozen plugin developers failed to fix their flawed apps despite each pushing out updates in the six months between the first test in which the holes were found and a second test run this month.

Seven of the top 10 most popular e-commerce apps dealing with payments or social media contained vulnerabilities. They had been downloaded 1.7 million times.

The apps contained a host of common vulnerabilities including cross-site scripting, cross-site forgery requests and SQL injection making WordPress sites prime targets for attack by exploit kits.

Security researchers have long flagged the need for WordPress site administrators to be vigilant in searching and fixing security issues.

Aging and since patched vulnerabilities in the TimThumb image resizer plugin has resulted in thousands of compromised websites.  

Web administrators should run vulnerability scans and source code analysis on their sites and plugins.

The Checkmarx report was online. (pdf)

Updated: The company said in a statement it did not disclose the names of the affected plug-ins citing a need to minimise exposure.

Our research of the state of WordPress plug-in was investigative and the publication is meant to raise awareness.

It is not a common practice to expose specific plug-ins that are contaminated – there is a disclosure procedure which we executed with most of the developers – enabling them to fix. 

Obviously public exposure of such plug-ins will make them immediate target for hackers and we try to avoid it. Our message to the public is a precautionary act and we recommend every site owner and developer to conduct certain activities to make sure the plug-ins she / he are using are OK, these steps are listed in the detailed research. 

Copyright © SC Magazine, Australia


Holes found in most popular WordPress plugins
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1124

Vote