Updates on WordPress security, Wordfence and what we're cooking in the lab today.

Author Archive: Ram Gall

Wordfence Blog

XSS Flaw Impacting 100,000 Sites Patched in KingComposer

This entry was posted in Research, Vulnerabilities, WordPress Security on July 09, 2020 by Ram Gall   0 Replies

On June 15, 2020, our Threat Intelligence team was made aware of a number of access control vulnerabilities that had recently been disclosed in KingComposer, a WordPress plugin installed on over 100,000 sites. During our investigation of these vulnerabilities, we discovered an unpatched reflected Cross-Site Scripting(XSS) vulnerability. Wordfence Premium customers received a new firewall rule …
Read More

Critical Vulnerabilities Patched in Adning Advertising Plugin

This entry was posted in Research, Vulnerabilities, WordPress Security on July 08, 2020 by Ram Gall   2 Replies

On June 24, 2020, our Threat Intelligence team was made aware of a possible vulnerability in the Adning Advertising plugin, a premium plugin with over 8,000 customers. We eventually discovered 2 vulnerabilities, one of which was a critical vulnerability that allowed an unauthenticated attacker to upload arbitrary files, leading to Remote Code Execution(RCE), which could …
Read More

Malware Detection: Measuring Recall to Catch Them All

This entry was posted in General Security, Wordfence, WordPress Security on June 24, 2020 by Ram Gall   2 Replies

At Wordfence, we take performance seriously on all levels. While speed is one way to measure performance, there are other metrics that are equally important. Over the past year, our Threat Intelligence team has improved our malware scan by leaps and bounds. We wanted to share some of the metrics we use and what they …
Read More

WordPress 5.4.2 Patches Multiple XSS Vulnerabilities

This entry was posted in Vulnerabilities, WordPress Security on June 11, 2020 by Ram Gall   2 Replies

WordPress Core version 5.4.2 has just been released. Since this release is marked as a combined security and bug fix update, we recommend updating as soon as possible. With that said, most of the security fixes themselves are for vulnerabilities that would require specific circumstances to exploit. All in all this release contains 6 security …
Read More

Large Scale Attack Campaign Targets Database Credentials

This entry was posted in General Security, Research, WordPress Security on June 03, 2020 by Ram Gall   24 Replies

Between May 29 and May 31, 2020, the Wordfence Firewall blocked over 130 million attacks intended to harvest database credentials from 1.3 million sites by downloading their configuration files. The peak of this attack campaign occurred on May 30, 2020. At this point, attacks from this campaign accounted for 75% of all attempted exploits of …
Read More

One Attacker Outpaces All Others

This entry was posted in Vulnerabilities, WordPress Security on May 13, 2020 by Ram Gall   32 Replies

Starting April 28th, we saw a 30 times increase in cross site scripting attack volume, originating from a single attacker, and targeting over a million WordPress sites. We published research detailing the threat actor and attack volume increase on May 5th. By the time we published, the attack volume had dropped back down to baseline …
Read More

Nearly a Million WP Sites Targeted in Large-Scale Attacks

This entry was posted in General Security, WordPress Security on May 05, 2020 by Ram Gall   23 Replies

Our Threat Intelligence Team has been tracking a sudden uptick in attacks targeting Cross-Site Scripting(XSS) vulnerabilities that began on April 28, 2020 and increased over the next few days to approximately 30 times the normal volume we see in our attack data. The majority of these attacks appear to be caused by a single threat …
Read More

Unpacking The 7 Vulnerabilities Fixed in Today’s WordPress 5.4.1 Security Update

This entry was posted in Vulnerabilities, WordPress Security on April 29, 2020 by Ram Gall   0 Replies

WordPress Core version 5.4.1 has just been released. Since this release is marked as a combined security and bug fix update, we recommend updating as soon as possible. With that said, most of the security fixes themselves are for vulnerabilities that appear to require specific circumstances to exploit. All in all this release contains 7 …
Read More

High Severity Vulnerability Patched in Ninja Forms

This entry was posted in Research, Vulnerabilities, WordPress Security on April 29, 2020 by Ram Gall   3 Replies

On April 27, 2020, the Wordfence Threat Intelligence team discovered a Cross-Site Request Forgery(CSRF) vulnerability in Ninja Forms, a WordPress plugin with over 1 million installations. This vulnerability could allow an attacker to trick an administrator into importing a contact form containing malicious JavaScript and replace any existing contact form with the malicious version. We …
Read More

High-Severity Vulnerabilities Patched in LearnPress

This entry was posted in Vulnerabilities, WordPress Security on April 28, 2020 by Ram Gall   3 Replies

On March 16, 2020, LearnPress – WordPress LMS Plugin, a WordPress plugin with over 80,000 installations, patched a high-severity vulnerability that allowed subscriber-level users to elevate their permissions to those of an “LP Instructor”, a custom role with capabilities similar to the WordPress “author” role, including the ability to upload files and create posts containing …
Read More

Follow Us

      


Protect your websites with the #1 WordPress Security Plugin

Get Premium
Over 150 million downloads

Wordfence Newsletter

Get WordPress Security Alerts and Product Updates