Posted on January 18, 2020 at 1:40 PM

Plugin Vulnerably in WordPress could give Hackers Total Control Over Your Site

A security team revealed that they had discovered a WordPress plugin that can be easily exploited by an attacker to infiltrate vulnerable websites. Users of the vulnerable plugin have been advised to update to the latest version as soon as possible to avoid being targeted by hackers.

The plugin is known as the WP Database Reset, which resets the database without the need to follow the conventional WordPress installation process. According to the security experts, this plugin vulnerability may potentially affect more than 80,000 sites since these numbers of sites are currently running the plugin on their WordPress portal.

Two Plugin vulnerabilities

The Wordfence security team that discovered this plugin vulnerability said they found two severe vulnerabilities. They further pointed out that hackers can use any of these vulnerabilities to take over or completely reset the website of the victim who installs this plugin on their WordPress portal.

According to the Wordfense security team, these vulnerabilities could be very damaging and devastating to websites. The team explained in detail in a blog post that the WordPress database stores all the data that make up the site, which includes comments, site options, users, pages, as well as posts. With this vulnerability, a hacker can clean out an entire WordPress installation with few clicks within a few seconds.

CVE-2020-7048, which is the first critical security flaw, could give anyone access to reset database without any authentication. This is possible since there was no check to secure any database reset function.

The second vulnerability WordFense discovered is known as CVE-2020-7047. This second vulnerability gives unauthenticated access to users to administrative privileges. It also allows an unauthorized user to block other users within the database through a simple request.

Flaw patched by the plugin developer

Wordfense initially informed the developer of the WP Database on January 8 after concluding its research. On January 13, the developer replied and told the team they would release a patch on the vulnerability the next day. A few days later, Wordfense disclosed its findings to the public, on the consent of the developer.

The latest security version to patch the vulnerability has been released, and users of the same plugin have been advised to upgrade as soon as possible. According to the security team, users who do not update on time risk losing their website entirely or having their website database completely wiped out.

WordPress website hacking statistics

It is no surprise that WordPress remains one of the major targets for hackers. That’s because of its enormous user-base. Most times, the major threat is not WordPress directly, but other third party plugins utilized by WordPress users.

These are usually the major targets and far the easiest because these plugins lack comprehensive monitoring. Whether WordPress makes its site extremely secure does not matter as long as these plugins are vulnerable. Through the plugins, hackers can gain considerable control over users’ sites.

Hackers can penetrate through these plugins because it allows third parties to include their extensions to the platform using different kinds of software and components. This approach certainly increases the chance of having a vulnerable plugin or component within the site’s portal. Once any WordPress user downloads and installs the vulnerable plugin, their site also becomes susceptible to attack.

The most common weaknesses found within WordPress plugins range from remote code execution to SQL injection, and disclosure of sensitive information. Since 35% of the world website owners registered their sites on WordPress, it is not surprising that the site has one of the highest numbers of vulnerabilities.

For a site that has more than 54,000 plugins, there is no doubt that some of the plugins would become vulnerable at one point.

And even though WordPress is trying to cut down on the number of plugins, it seems the number of vulnerabilities is still increasing. The reason for this could be the quality of the code, or hackers are constantly trying to develop tools that would render WordPress plugins vulnerable.

More worrisome is the fact that about 98% of WordPress’s susceptibility is related to plugins. This explains quite a lot that plugin developers are not doing enough to develop secured and quality codes for the plugins.