WARNING: MAJOR new WordPress vulnerability
A very new major vulnerability affecting recent versions of WordPress,
likely millions of running instances, is currently being massively
exploited in the wild.
The exploit permits unauthenticated users to gain administrative
access and control.
The typical pattern is that the exploit gains control, changes the
administrator password, creates a number of additional administrators
and attempts to access "xmlrpc.php" to morph the site into a malware,
etc. distribution site.
If the xmlrpc.php is already blocked on the site, the exploit possibly
may not proceed further immediately, but would still leave the
additional new administrative users behind.
There are several mitigation techniques even if you are running a
vulnerable site and cannot upgrade. The key points are to block the
main exploit entry point, remove the additional administrative user
entries, and ideally block remote access to the main WordPress login
page itself.
More info including a test for vulnerability is at:
https://wp2shell.com/
L
- - -
--Lauren--
Lauren Weinstein
[email protected] (https://www.vortex.com/lauren)
Lauren's Blog: https://lauren.vortex.com
Mastodon: https://mastodon.laurenweinstein.org/@lauren
Signal: By request on need to know basis
Founder: Network Neutrality Squad: https://www.nnsquad.org
PRIVACY Forum: https://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility
_______________________________________________
pfir mailing list
https://lists.pfir.org/mailman/listinfo/pfir
