Holes found in most popular WordPress plugins

Powered by SC Magazine
 

Plugins downloaded millions of times.

Updated: Twelve of the most popular WordPress plugins that have been downloaded millions of times contain unpatched vulnerabilities.

Checkmarx researchers reported vulnerabilities in 18 of the top 50 most downloaded plugins which could allow attackers to compromise websites.

But a dozen plugin developers failed to fix their flawed apps despite each pushing out updates in the six months between the first test in which the holes were found and a second test run this month.

Seven of the top 10 most popular e-commerce apps dealing with payments or social media contained vulnerabilities. They had been downloaded 1.7 million times.

The apps contained a host of common vulnerabilities including cross-site scripting, cross-site forgery requests and SQL injection making WordPress sites prime targets for attack by exploit kits.

Security researchers have long flagged the need for WordPress site administrators to be vigilant in searching and fixing security issues.

Aging and since patched vulnerabilities in the TimThumb image resizer plugin has resulted in thousands of compromised websites.  

Web administrators should run vulnerability scans and source code analysis on their sites and plugins.

The Checkmarx report was online. (pdf)

Updated: The company said in a statement it did not disclose the names of the affected plug-ins citing a need to minimise exposure.

Our research of the state of WordPress plug-in was investigative and the publication is meant to raise awareness.

It is not a common practice to expose specific plug-ins that are contaminated – there is a disclosure procedure which we executed with most of the developers – enabling them to fix. 

Obviously public exposure of such plug-ins will make them immediate target for hackers and we try to avoid it. Our message to the public is a precautionary act and we recommend every site owner and developer to conduct certain activities to make sure the plug-ins she / he are using are OK, these steps are listed in the detailed research. 

Copyright © SC Magazine, Australia


Holes found in most popular WordPress plugins
 
 
 
Top Stories
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
A call for timely reporting
[Blog post] Businesses need incentives to keep customer data secure.
 
Doubts cast on Queensland's ICT Dashboard
Opposition, former Govt CIO say it can't be trusted.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  26%
 
Application integration concerns
  3%
 
Security and compliance concerns
  29%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 840

Vote