50,000 websites vulnerable thanks to shoddy WordPress plugin

Around 50,000 websites are currently vulnerable to malware and backdoor access thanks to a security hole found in a Word Press plugin, according to researcher, Daniel Cid. Security firm, Sucuri, says that new malware can infect any site that resides on the same server as a hacked Word Press site.

The flawed plugin would allow hackers to inject anything in to websites, from spam and defacements to malware. The plugin in question is called MailPoet, the security hole has been fixed but if site owners don't upgrade their software then they will remain vulnerable for the forseeable future. Here's a graph showing the number of infections over the last two weeks:

You don't have to be using MailPoet yourself to be affected, if any website on the same server has the plugin then your site is vulnerable, a Sucuri blog post reads: “The malware code had some bugs: it was breaking many websites, overwriting good files and appending various statements in loops at the end of files.”

“To be clear, the MailPoet vulnerability is the entry point, it doesn’t mean your website has to have it enabled or that you have it on the website; if it resides on the server, in a neighboring website, it can still affect your website.”

Discuss on our Facebook page, HERE.

KitGuru Says: This is bad news for Word Press site owners and users. Hopefully the 50,000 vulnerable sites upgrade soon in order to avoid being affected. 

Source: The Register

Become a Patron!