800K WordPress sites still impacted by critical SEO plugin flaw

by | Dec 22, 2021 | News

seo wordpress plugin all in one critical vulnerability

Post Views: 1,035

Reading Time: 1 Minute

 

Two critical and high severity security vulnerabilities in the highly popular “All in One” SEO WordPress plugin exposed over 3 million websites to takeover attacks.

 

 

The security flaws discovered and reported by Automattic security researcher Marc Montpas are a critical Authenticated Privilege Escalation bug (CVE-2021-25036) and a high severity Authenticated SQL Injection (CVE-2021-25037).

 

Over 800,000 vulnerable WordPress sites

 

The plugin’s developer released a security update to address both All in One bugs on December 7, 2021.

However, more than 820,000 sites using the plugin are yet to update their installation, according to download statistics for the last two weeks since the patch was released, and are still exposed to attacks. 

What makes these flaws highly dangerous is that, even though successfully exploiting the two vulnerabilities requires threat actors to be authenticated, they only need low-level permissions such as Subscriber to abuse them in attacks.

 

See Also: Complete Offensive Security and Ethical Hacking Course

 

 

 

Subscriber is a default WordPress user role (just as Contributor, Author, Editor, and Administrator), commonly enabled to allow registered users to comment on articles published on WordPress sites.

Although subscribers are typically only able to edit their own profile besides posting comments, in this case, they can exploit CVE-2021-25036 to elevate their privileges and gain remote code execution on vulnerable sites and, likely, completely take them over.

 

DateDownloads
2021-12-07336738
2021-12-081403672
2021-12-0968941
2021-12-1045392
2021-12-1131346
2021-12-1226677
2021-12-1335666
2021-12-1434938
2021-12-1572301
2021-12-1628672
2021-12-1724699
2021-12-1818774
2021-12-1917972
2021-12-2025388
Total2171176
 

 

 
 
 
 
 
 
 
 
 
 
 

 

WordPress admins urged to update ASAP

 

As Montpas revealed, escalating privileges by abusing CVE-2021-25036 is an easy task on sites running an unpatched All in One SEO version by “changing a single character to uppercase” to bypass all implemented privilege checks.

“This is particularly worrying because some of the plugin’s endpoints are pretty sensitive. For example, the aioseo/v1/htaccess endpoint can rewrite a site’s htaccess with arbitrary content,” Montpas explained.

“An attacker could abuse this feature to hide htaccess backdoors and execute malicious code on the server.”

WordPress admins still using All In One SEO versions affected by these severe vulnerabilities (between 4.0.0 and 4.1.5.2) who haven’t already installed the 4.1.5.3 patch are advised to do it immediately.

 
 
 

 

See Also: Offensive Security Tool: log4j-scan

 

“We recommend that you check which version of the All In One SEO plugin your site is using, and if it is within the affected range, update it as soon as possible,” the researcher warned one week ago.

 
 

 

See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell

 

Source: www.bleepingcomputer.com

 

(Click Link)

 

 

store

Share This