We are seeing reports that a vulnerability in the Absolute Privacy WordPress plugin (link) is being used to hack and compromise sites with it installed.
This plugin has a serious unpatched security vulnerability that allows anyone to login in the WordPress site without a password. From Secunia:
Schaffnern has discovered a vulnerability in the Absolute Privacy plugin for WordPress, which can be exploited by malicious people to bypass certain security restrictions.
The vulnerability is caused due to an error within the “abpr_authenticateUser()” function in wp-content/plugins/absolute-privacy/functions.php, which prevents the password from being verified. This can be exploited to bypass the authentication mechanism and gain administrative access to the application.
The vulnerability is confirmed in version 2.0.5. Other versions may also be affected.
Note that this plugin has had more than 35 thousand downloads and no patches for this bug. We recommend deleting this plugin asap until a fix is in place.
Our team is still analysing this vulnerability and we will post more details soon. Additional information and original report was found here.
If you think your site has been compromised, you can verify it in here: http://sitecheck.sucuri.net
Luke Leal
Krasimir Konov
Fioravante Souza
Marc Kranat
Ben Martin
Douglas Santos
Peter Gramantik
Denis Sinegubko
4 comments
The fix has been posted on wordpress.org for a few months: http://wordpress.org/support/topic/absolute-privacy-badly-broken Hopefully the author will put this into the official plugin, though currently it has been pulled from the wordpress.org plugin downloads section.
The latest version (v 2.0.6 posted today) fixes this vulnerability. The plugin is once again available from the official repository. You should update your site immediately!
thank…
Comments are closed.