Critical vulnerabilities in a popular WordPress plugin appear to have exposed more 100,000 websites to site takeovers.

Detailed Wednesday by security researcher Chloe Chamberland at Wordfence, the vulnerabilities were found in Responsive Menu, a plugin that offers customizable mobile-friendly menu options in WordPress installs.

The first vulnerability makes it possible for authenticated attackers with low-level permissions to upload arbitrary files and achieve remote code execution. The other two vulnerabilities made it possible for attackers to forge requests that would modify the settings of the plugin and also upload arbitrary files that could lead to remote code execution. All three vulnerabilities, along with delivering site takeover functionality could also allow an attacker to install backdoors, spam injections, malicious redirects and other malicious activities.

The vulnerabilities were discovered Dec. 17, but getting them addressed by ExpressTech, the developer of Responsive Menu, turned into a challenge. After receiving no response in December, researchers at Wordfence reached out again to the developers Jan. 4 with no response.

Given their inability to get a response from the developers of the plugin, the researchers then contacted the WordPress Plugins team Jan. 10 and a response came the next day. The plugin was patched Jan. 19.

That’s a positive, but the Wordfence team noted that many users of the plugin are still running the old, vulnerable version of the plugin. “We recommend that users immediately update to the latest version available, which is version 4.0.4 at the time of this publication,” the researchers say.

Unfortunately, WordPress plugins with vulnerabilities are common. Ameet Naik, security evangelist at application protection firm PerimeterX Inc., told SiliconANGLE that it’s just one of many plugins that are lucrative targets for hackers determined to compromise e-commerce sites.

“Outdated or vulnerable plugins are a pathway to inject malicious Shadow Code that can have full access to a WordPress website,” Naik explained. “Such techniques have been used to launch digital skimming and Magecart attacks against thousands of e-commerce sites, resulting in the theft of millions of credit card numbers.”

Website owners need to review third-party plugins thoroughly and ensure they upgrade to the latest versions, Naik added. And consumers must also continue to safeguard their personal data and monitor their credit history for signs of fraud.

Image: Responsive Menu