By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    Morris Worm Turns 25
    12 months ago
    Meet the iPhone malware that tracks your every move
    12 months ago
    Virus can inflict physical harm onto a PC: myth or truth?
    12 months ago
    Latest News
    Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
    4 days ago
    Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
    5 days ago
    Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
    6 days ago
    Agent Tesla’s Unique Approach: VBS and Steganography for Delivery and Intrusion
    1 week ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    Why none of the Windows 8 upgrade guides you find will help
    12 months ago
    Windows 11 build 25188 outs with touch keyboard updates
    12 months ago
    How to upgrade from Windows 10 to Windows 11
    12 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    7 months ago
    Now you can speed up any video in your browser
    7 months ago
    How to restore access to a file after EFS or view it on another computer?
    8 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    8 months ago
  • How To
    How ToShow More
    Welcome to Birthday Week 2023
    Welcome to Birthday Week 2023
    19 hours ago
    A new wave of innovation with Edge, your AI-powered browser
    2 days ago
    Curator can help you with PC Game Pass picks
    2 days ago
    Cloudflare Email Security now works with CrowdStrike Falcon LogScale
    Cloudflare Email Security now works with CrowdStrike Falcon LogScale
    4 days ago
    New! Rate Limiting analytics and throttling
    New! Rate Limiting analytics and throttling
    6 days ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    Update Telegram 5.0.2. Telegram bug with IOS
    9 months ago
    Getting root rights on the device
    11 months ago
    5 Chips with VKontakte
    11 months ago
    Latest News
    How to use image layers on Paint for Windows 11
    5 days ago
    How to disable Copilot on Windows 11 (completely)
    1 week ago
    How to blur image background in Photos for Windows 11
    1 week ago
    How to hide text from screenshots on Snipping Tool for Windows 11
    1 week ago
  • Glossary
  • My Bookmarks
Reading: WordPress developers have disabled plugins produced by Multidots due to their insecurity
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
ThreatsWordpress Threats

WordPress developers have disabled plugins produced by Multidots due to their insecurity

Tom Grant
Last updated: 13 October
Tom Grant 2 years ago
Share
3 Min Read

ThreatPress specialists discovered that ten e-commerce plugins produced by Multidots contain vulnerabilities and pose a danger to users. Previously, all plugins were available for download through the official WordPress.org repository and were intended for users of the WooCommerce platform.

In total, the vulnerable solutions had about 20,000 active installations (including 10,000 installations for the Page Visit Counter plugin, 3,000 installations for the WooCommerce Category Banner Management, and 1,000 installations for the WooCommerce Checkout for Digital Goods).

ThreatPress analysts write that Multidots plugins were vulnerable to various XSS, CSRF and SQL injections. Four bugs have already received CVE IDs (CVE-2018-11579, CVE-2018-11580, CVE-2018-11633 and CVE-2018-11632), while the rest are still waiting in line.

Exploiting these problems, attackers could take control of a site that uses insecure plugins. According to the researchers, the attackers were able to deface a vulnerable site, remotely execute shells, inject a keylogger, a hidden miner, or any other malware onto the site. Given that vulnerable sites are online stores, attackers had a chance to get valuable financial and personal information about visitors to such resources.

“The vulnerabilities allowed an unauthenticated attacker to inject [a site] with malicious JavaScript, which made it possible to intercept data about bank cards of customers and their personal information,” the researchers say.

To exploit the vulnerabilities, the victim had to be forced to go to a specially prepared URL or visit a specific page. However, some problems could be used without user interaction. Detailed information about the vulnerabilities and proof-of-concept exploits for each bug can be found on the ThreatPress blog.

Experts notified the developers of Multidots about what was happening back in early May 2018. They acknowledged the problem, but the fixes were never released. After that, the researchers were forced to seek help from WordPress experts, who promptly disabled most of the vulnerable plugins, preventing them from loading from the repository.

ThreatPress experts sadly note that these actions , unfortunately, will not help to secure all those who are already using vulnerable plugins. The thing is that WordPress displays information about available updates, but does not warn that some plugins have been found dangerous and their distribution has been suspended.

Translate this article

TAGGED: Malware, PoC, SQL injection, Threats, Vulnerabilities, WordPress
Tom Grant October 13, 2022 October 31, 2021
Share This Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Welcome to Birthday Week 2023
Welcome to Birthday Week 2023
Apps 19 hours ago
A new wave of innovation with Edge, your AI-powered browser
Windows 2 days ago
Curator can help you with PC Game Pass picks
Windows 2 days ago
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Apps 4 days ago
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Wordpress Threats 4 days ago

You Might Also Like

Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Apps

Cloudflare Email Security now works with CrowdStrike Falcon LogScale

4 days ago
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Wordpress Threats

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)

4 days ago
Threats

Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog

5 days ago
Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
Wordpress Threats

Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks

6 days ago
Show More

Related stories

How to upgrade to Windows 11 23H2 with Installation Assistant
Critical Vulnerability in Forminator Plugin
How to blur image background in Photos for Windows 11
How to download official Windows 11 23H2 ISO file
PHP Object Injection Vulnerability in Flatsome Theme
How to download Windows 11 22H2 ISO after 23H2 releases
Previous Next

10 New Stories

Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
How to use image layers on Paint for Windows 11
New! Rate Limiting analytics and throttling
Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
Agent Tesla’s Unique Approach: VBS and Steganography for Delivery and Intrusion
Privilege Escalation Vulnerability in Essential Addons for Elementor
Previous Next
Hot News
Welcome to Birthday Week 2023
A new wave of innovation with Edge, your AI-powered browser
Curator can help you with PC Game Pass picks
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
10alert.com10alert.com
Follow US
© 10 Alert Network. All Rights Reserved.
  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?