Holes found in most popular WordPress plugins

Powered by SC Magazine
 

Plugins downloaded millions of times.

Updated: Twelve of the most popular WordPress plugins that have been downloaded millions of times contain unpatched vulnerabilities.

Checkmarx researchers reported vulnerabilities in 18 of the top 50 most downloaded plugins which could allow attackers to compromise websites.

But a dozen plugin developers failed to fix their flawed apps despite each pushing out updates in the six months between the first test in which the holes were found and a second test run this month.

Seven of the top 10 most popular e-commerce apps dealing with payments or social media contained vulnerabilities. They had been downloaded 1.7 million times.

The apps contained a host of common vulnerabilities including cross-site scripting, cross-site forgery requests and SQL injection making WordPress sites prime targets for attack by exploit kits.

Security researchers have long flagged the need for WordPress site administrators to be vigilant in searching and fixing security issues.

Aging and since patched vulnerabilities in the TimThumb image resizer plugin has resulted in thousands of compromised websites.  

Web administrators should run vulnerability scans and source code analysis on their sites and plugins.

The Checkmarx report was online. (pdf)

Updated: The company said in a statement it did not disclose the names of the affected plug-ins citing a need to minimise exposure.

Our research of the state of WordPress plug-in was investigative and the publication is meant to raise awareness.

It is not a common practice to expose specific plug-ins that are contaminated – there is a disclosure procedure which we executed with most of the developers – enabling them to fix. 

Obviously public exposure of such plug-ins will make them immediate target for hackers and we try to avoid it. Our message to the public is a precautionary act and we recommend every site owner and developer to conduct certain activities to make sure the plug-ins she / he are using are OK, these steps are listed in the detailed research. 

Copyright © SC Magazine, Australia


Holes found in most popular WordPress plugins
 
 
 
Top Stories
NBN Co names first 140 FTTN sites
National trial extended.
 
Cloud, big data propel bank CISOs into the boardroom
And this time, they are welcome.
 
Photos: AISA National Conference 2014
Highlight's from Australia's volunteer-run information security event.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  23%
 
End user computing (desktops, mobiles, apps)
  12%
 
Software development
  27%
TOTAL VOTES: 233

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  62%
 
No
  38%
TOTAL VOTES: 72

Vote