Source: www.databreachtoday.com – Author:
Identity & Access Management , Security Operations
Critical Authentication Flaw Impacts Both Free and Pro Users Prajeet Nair (@prajeetspeaks) • November 18, 2024
A widely deployed five-in-one security plug-in for WordPress websites contained a flaw that hackers could automate into a large-scale takeover campaign.
See Also: Stop Them: Combating Identity Attacks on Your Health System
WordPress security firm Wordfence called the flaw, tracked as CVE-2024-10924, “one of the more serious vulnerabilities that we have reported on in our 12-year history.”
The critical authentication bypass vulnerability takes advantage of a now-patched flaw in the Really Simple Security plug-in, active across more than 4 million websites. WordPress.org began forced updates on Thursday. “We urge users to verify that their sites were updated to the latest patched version of Really Simple Security, version 9.1.2,” Wordfence researchers wrote. The flaw impacts free, Pro and Pro Multisite editions.
The flaw stems from improper handling of user verification during two-factor authentication processes via the REST API, which is a protocol for systems to communicate over the web. Only plug-ins that enable two-factor authentication for login are affected by the flaw, and the setting is disabled by default. Really Simple Security contains functions for managing website certificates, vulnerability detection, login protection and WordPress hardening.
Specifically, the error is in how the plug-in returned an error message in the case of a two-factor authentication failure. Prior to the patch, the plug-in did not handle the error message within the function, meaning that even in the case of an invalid response, a hacker could continue logging on. “Even in the case of an invalid nonce, the function processing continues and invokes authenticate_and_redirect(), which authenticates the user based on the user ID passed in the request, even when that user’s identity hasn’t been verified,” Wordfence wrote.
WordFence researchers disclosed the vulnerability to the developer team on Nov. 6. The flaw, which has a 9.8 rating on the ten-point CVSS scale, is scriptable, “meaning that it can be turned into a large-scale automated attack.”
Original Post url: https://www.databreachtoday.com/wordpress-plug-in-vulnerability-threatens-4-million-sites-a-26843
Category & Tags: –
Views: 0
