INFRA
INFRA
INFRA
Almost 2M WordPress sites defaced thanks to security vulnerability
A serious content-injection vulnerability in the popular WordPress content management system, first discovered at the end of January, has been used to deface more than 1.9 million sites.
Seattle-based security firm WordFence Inc., which described it as “one of the worst WordPress related vulnerabilities to emerge in some time,” said in a blog post that the vulnerability had been used by hackers to post political messages in support of the Kurdish Peshmerga group fighting against both the Islamic State and the Turkish army in Northern Syria.
The hack uses a so-called unauthenticated privilege escalation vulnerability in a REST API endpoint that was introduced into WordPress versions 4.7 and 4.7.1. The new versions were intended to provide easier access to posts, comments, terms and other settings. Instead, the vulnerability resulted in a kind of “feeding frenzy where attackers are competing with each other to deface vulnerable WordPress websites,” said the company, which noted that so far it had tracked more than 20 different defacement campaigns.
WordPress.org, the company behind the open-source code, pushed a new patched version of the content management system on Jan. 26, but revealed the vulnerability Feb. 1 in an effort to encourage users to update their WordPress installs.
“We believe transparency is in the public’s best interest,” said Aaron D. Campbell, a contributor to WordPress who works at GoDaddy. “It is our stance that security issues should always be disclosed. In this case, we intentionally delayed disclosing this issue by one week to ensure the safety of millions of additional WordPress sites.”
Security firm Securi warned separately that some hacker groups had since moved on from defacement and were now attempting to use the bug to hijack sites for their own ends. “Attackers are starting to think of ways to monetise this vulnerability,” Sucuri founder Daniel Cid explained in a blog post. “Defacements don’t offer economic returns, so that will likely die soon.”
Users are encouraged to immediately update all their WordPress installations if they have not done so already.
(Editors Note: An earlier version of the article said “Automattic Inc., the company behind WordPress, pushed a new patched version of the content management system.” The note was actually from WordPress.org.)
Image: Wordfence/unknown creator
A message from John Furrier, co-founder of SiliconANGLE:
Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.
- 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more
- 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network.
About SiliconANGLE Media
SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.
