Experts Notice Sudden Surge in Exploitation of WordPress Page Builder Plugin Vulnerability

Technology

Researchers from Wordfence have sounded the alarm about a “sudden” spike in cyber attacks attempting to exploit an unpatched flaw in a WordPress plugin called Kaswara Modern WPBakery Page Builder Addons.

Tracked as CVE-2021-24284, the issue is rated 10.0 on the CVSS vulnerability scoring system and relates to an unauthenticated arbitrary file upload that could be abused to gain code execution, permitting attackers to seize control of affected WordPress sites.

CyberSecurity

Although the bug was originally disclosed in April 2021 by the WordPress security company, it continues to remain unresolved to date. To make matters worse, the plugin has been closed and is no longer actively maintained.

Wordfence, which is protecting over 1,000 websites that have the plugin installed, said it has blocked an average of 443,868 attack attempts per day since the start of the month.

WordPress Page Builder Plugin Vulnerability

The attacks have emanated from 10,215 IP addresses, with a majority of the exploitation attempts narrowed down to 10 IP addresses. These involve uploading a ZIP archive containing a malicious PHP file that allows the attacker to upload rogue files to the infected website.

CyberSecurity

The goal of the campaign, it appears, is to insert code into otherwise legitimate JavaScript files and redirect site visitors to malicious websites. It’s worth noting that the attacks have been tracked by Avast and Sucuri under the monikers Parrot TDS and NDSW, respectively.

Between 4,000 and 8,000 websites are said to have the plugin installed, making it imperative that users remove it from their WordPress sites to thwart potential attacks and find an appropriate alternative.

Products You May Like

Articles You May Like

SoCal to get brief break from rain before next storm rolls in next weekend – NBC Los Angeles
Fire-Boltt Oracle With 4G LTE SIM Support, 1.96-Inch Display Launched in India: Price, Specifications
Powerball jackpot jumps to $800 million for Monday – NBC Los Angeles
China slams U.S. for interfering in Arunachal Pradesh dispute with India
Frozen Empire Director Addresses Bringing Back Rick Moranis