Stories
Slash Boxes
Comments

SoylentNews is people

WordPress Sites Hacked through Defunct Rich Reviews Plugin

posted by janrinok on Thursday October 03 2019, @11:55PM   Printer-friendly
from the stay-current dept.

Fnord666 writes:

WordPress Sites Hacked Through Defunct Rich Reviews Plugin

An estimated 16,000 websites are believed to be running a vulnerable and no-longer-maintained WordPress plugin that can be exploited to display pop-up ads and redirect visitors to webpages containing porn, scams, and–worst of all–malware designed to infect users' computers.

Researchers at WordFence went public about how hackers are exploiting a zero-day vulnerability in a third-party WordPress plugin called Rich Reviews to inject malvertising code into vulnerable WordPress sites.

The threat is not theoretical.

Website owners have posted publicly about how they have been hit by scripting malware, and they are pointing the finger of blame at the Rich Reviews plugin.

Normally the advice would be for website administrators to update the plugin, thereby patching the security hole and preventing hackers from being able to compromise their websites. But in this instance, there is no update, and there may never be... because the developers of Rich Reviews stopped maintaining their software long ago.

And in March 2019, after a total of 106,000 downloads, the plugin was removed from the official WordPress plugin library, reducing the chances of more websites installing it. The reason given for its removal? "Security issue."

Source: tripwire.com

Original Submission

 
This discussion has been archived. No new comments can be posted.
WordPress Sites Hacked through Defunct Rich Reviews Plugin | Log In/Create an Account | Top | 5 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 1) by soylentnewsinator on Friday October 04 2019, @12:59AM (1 child)

    by soylentnewsinator (7102) on Friday October 04 2019, @12:59AM (#902497)

    This is why I opted for a non-feature rich option bolt.cm when I was looking at CMS options. If I absolutely need a feature it doesn't have, then I'll consider migrating, but I suspect most sites, like mine, don't need the WordPress or Drupal ecosystem.

  • (Score: 0) by Anonymous Coward on Saturday October 05 2019, @08:04AM

    by Anonymous Coward on Saturday October 05 2019, @08:04AM (#902986)

    Hadn't spotted Bolt before..

    Fsck me, having done a number of Wordpress installs, Bolt was a (mostly¹) painless install and configure, even when running on nginx, and now the culture shock of driving a CMS begins.....unless I make it SEFP.

    --

    ¹ Mostly, as my existing php install had most things disabled by default...even after recompiling php to enable it, I suspect my GD support is still somehow borked..yaay!, a weekend php debugging project for the boring Sunday afternoon..oh! joy, oh! rapture...