Enlarge (credit: Getty Images)

All-In-One Security, a WordPress security plugin installed on more than 1 million websites, has issued a security update after being caught three weeks ago logging plaintext passwords and storing them in a database accessible to website admins.

The passwords were logged when users of a site using the plugin, typically abbreviated as AIOS, logged in, the developer of AIOS said Thursday . The developer said the logging was the result of a bug introduced in May in version 5.1.9. Version 5.2.0 released Thursday fixes the bug and also “deletes the problematic data from the database.” The database was available to people with administrative access to the website.

A major security transgression

A representative of AIOS wrote in an email that “gaining anything from this defect requires being logged in with the highest-level administrative privileges, or equivalent. i.e. It can be exploited by a rogue admin who can already do such things because he's an admin.”

Enlarge (credit: Erika Goldring / Contributor | Getty Images North America )

Over the past week, backlash erupted on LinkedIn , in a thread where passionate open source developers began criticizing Pantheon. The developers and other Pantheon supporters commenting had just discovered that the website operations platform—which hosts more than 700,000 websites—is currently hosting websites for hugely influential anti-LGBTQ and anti-immigration organizations that have been designated as hate groups by the Southern Poverty Law Center (SPLC).

The controversy sparked after a digital strategist, Greg Dunlap, posted a link to SPLC’s page designating a Christian conservative legal advocacy group, Alliance Defending Freedom (ADF), as a hate group for its views on the LGBTQ community. On the page, SPLC described ADF as supporting “recriminalization of sexual acts between consenting LGBTQ adults in the US and criminalization abroad,” defending “state-sanctioned sterilization of trans people abroad,” and claiming that a “homosexual agenda” will “destroy Christianity and society.”

In his LinkedIn post, Dunlap tagged Pantheon co-founders Josh Koenig and Zack Rosen, and asked them why Pantheon is hosting a website for the alleged hate group. ADF also has ties to high-ranking Republicans and has influenced Supreme Court opinions (including the decision to overturn Roe v. Wade ).

Enlarge (credit: Getty Images)

Hackers are actively exploiting a critical vulnerability in a widely used WordPress plugin that gives them the ability to take complete control of millions of sites, researchers said.

The vulnerability, which carries a severity rating of 8.8 out of a possible 10, is present in Elementor Pro, a premium plugin running on more than 12 million sites powered by the WordPress content management system. Elementor Pro allows users to create high-quality websites using a wide range of tools, one of which is WooCommerce, a separate WordPress plugin. When those conditions are met, anyone with an account on the site—say a subscriber or customer—can create new accounts that have full administrator privileges.

The vulnerability was discovered by Jerome Bruandet, a researcher with security firm NinTechNet. Last week, Elementor, the developer of the Elementor Pro plugin, released version 3.11.7, which patched the flaw. In a post published on Tuesday, Bruandet wrote:

Enlarge (credit: CHUYN / Getty Images )

Nearly 11,000 websites in recent months have been infected with a backdoor that redirects visitors to sites that rack up fraudulent views of ads provided by Google Adsense, researchers said.

All 10,890 infected sites, found by security firm Sucuri , run the WordPress content management system and have an obfuscated PHP script that has been injected into legitimate files powering the websites. Such files include “index.php,” “wp-signup.php,” “wp-activate.php,” “wp-cron.php,” and many more. Some infected sites also inject obfuscated code into wp-blog-header.php and other files. The additional injected code works as a backdoor that’s designed to ensure the malware will survive disinfection attempts by loading itself in files that run whenever the targeted server is restarted.

“These backdoors download additional shells and a Leaf PHP mailer script from a remote domain filestack[.]live and place them in files with random names in wp-includes, wp-admin and wp-content directories,” Sucuri researcher Ben Martin wrote. “Since the additional malware injection is lodged within the wp-blog-header.php file it will execute whenever the website is loaded and reinfect the website. This ensures that the environment remains infected until all traces of the malware are dealt with.”

Enlarge

Malware that exploits unpatched vulnerabilities in 30 different WordPress plugins has infected hundreds if not thousands of sites and may have been in active use for years, according to a writeup published last week.

The Linux-based malware installs a backdoor that causes infected sites to redirect visitors to malicious sites, researchers from security firm Dr.Web said . It’s also able to disable event logging, go into standby mode, and shut itself down. It gets installed by exploiting already-patched vulnerabilities in plugins that website owners use to add functionality like live chat or metrics-reporting to the core WordPress content management system.

“If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted web pages are injected with malicious JavaScripts,” Dr.Web researchers wrote. “As a result, when users click on any area of an attacked page, they are redirected to other sites.”

Create a custom WordPress post type to keep your ideas in one place. The following example will create Ideas menu entry where you can jot down your ideas. The whole process is really fun. <?php /** * Plugin Name: Ideas * Plugin URI: https://github.com/milosz/wp-ideas * Description: Ideas * Version: 0.4.0 * Requires at least: 5.8 […]

---

Značky: #WordPress, #DailyOps, #Linux

Use docker-compose to instantly setup a development WordPress instance. I will use http://127.0.0.127:8080 address, admin user with 9YyO0T9sPqGplvL0 password. Create plugins directory to locally edit plugins. $ mkdir plugins Inspect docker-compose configuration. $ cat docker-compose.yml version: '2' services: wordpress: image: wordpress environment: - WORDPRESS_DB_HOST=database - WORDPRESS_DB_NAME=wordpress - WORDPRESS_DB_PASSWORD=C8aouSKnyPUV0l0u - WORDPRESS_DB_USER=wordpress ports: - "127.0.0.127:8080:80" volumes: - […]

---

Značky: #WordPress, #DevOps, #Linux