Three well-liked ecommerce plugins for WordPress (WP) installations, open to SQL injection assaults since December 2022, have been patched, defending companies from menace actors modifying or deleting their web sites.
The three affected plugins, as found by Tenable safety researcher Joshua Martinelle (opens in new tab) (through BleepingComputer (opens in new tab)), have been ‘Paid Memberships Professional (opens in new tab)’, a subscription administration software energetic on over 100,000 installations, ‘Simple Digital Downloads (opens in new tab)’, an e-commerce software energetic on over 50,000 installations, and ‘Survey Marker (opens in new tab)’ (a market analysis software with over 3,000 energetic installations)
SQL injections are safety flaws that permit attackers to enter information into web site types or URLs to change databases. Attackers can use vulnerabilities that permit SQL injections to inject scripts designed to change web sites, or acquire unauthorized entry to their backends.
WordPress SQL injections
Whereas all web sites might be weak to SQL injection throughout improvement, WordPress installations, hosted on a preferred, centralized platform stocked with many widespread plugins, are a preferred goal for menace actors on the lookout for exploits.
In January 2023 alone, TechRadar Professional has reported on different WP plugins providing stay chat performance being leveraged, over the course of three years, to execute JavaScript code that redirects customers to malicious web sites, in addition to one other related exploit concentrating on a plug-in including reward card performance to on-line shops.
Fortunately, after disclosure of the issues and the discharge of proof-of-concept exploits (PoCs) by Martinelle to WordPress on 19 December 2022, the builders of the plugins moved quick to handle the issues, with fixes being launched in a matter of weeks, and even days.
A repair for ‘Survey Maker’, as a part of model 3.1.2 of the plugin, was launched as quickly because the twenty first of December. ‘Paid Memberships Professional’ adopted on the twenty seventh, with a repair rolled into model 2.9.8, and ‘Simple Digital Downloads’ adopted on 5 January 2023 as a part of model 3.1.0.4.
In the event that they haven’t already, affected customers are suggested to replace these plugins to the newest variations to guard themselves from SQL injection assaults for the foreseeable future.
- Right here’s our checklist of the greatest options to WordPress proper now