{"id":4734,"date":"2024-04-27T10:43:50","date_gmt":"2024-04-27T17:43:50","guid":{"rendered":"https:\/\/www.ultimatewb.com\/blog\/?p=4734"},"modified":"2024-04-27T10:43:51","modified_gmt":"2024-04-27T17:43:51","slug":"popular-wordpress-plugin-targeted-by-hackers-millions-of-sites-at-risk","status":"publish","type":"post","link":"https:\/\/www.ultimatewb.com\/blog\/4734\/popular-wordpress-plugin-targeted-by-hackers-millions-of-sites-at-risk\/","title":{"rendered":"Popular WordPress Plugin Targeted by Hackers: Millions of Sites at Risk"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.ultimatewb.com\/blog\/wp-content\/uploads\/wp-automatic-plugin.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"639\" src=\"https:\/\/www.ultimatewb.com\/blog\/wp-content\/uploads\/wp-automatic-plugin-1024x639.jpg\" alt=\"\" class=\"wp-image-4735\" srcset=\"https:\/\/www.ultimatewb.com\/blog\/wp-content\/uploads\/wp-automatic-plugin-1024x639.jpg 1024w, https:\/\/www.ultimatewb.com\/blog\/wp-content\/uploads\/wp-automatic-plugin-300x187.jpg 300w, https:\/\/www.ultimatewb.com\/blog\/wp-content\/uploads\/wp-automatic-plugin-768x480.jpg 768w, https:\/\/www.ultimatewb.com\/blog\/wp-content\/uploads\/wp-automatic-plugin.jpg 1225w\" sizes=\"(max-width: 600px) 100vw, (max-width: 1200px) 75vw, 1200px\" \/><\/a><\/figure>\n\n\n\n<p>WordPress website owners beware! Security researchers have uncovered a critical vulnerability in a widely used plugin that could allow hackers to completely take over websites.<\/p>\n\n\n\n<p>The targeted plugin, WP-Automatic, is designed to automate content import and publishing from various sources. According to Patchstack, a WordPress security firm, the vulnerability is a type of SQL injection (SQLi) flaw. SQLi attacks exploit weaknesses in how a website interacts with its database, potentially allowing unauthorized access and control.<\/p>\n\n\n\n<p>The severity of the situation is underscored by the number of potentially affected websites. Reports indicate that WP-Automatic boasts over five million active installations.<\/p>\n\n\n\n<p>&#8220;Hackers could leverage this flaw to gain unauthorized access to websites, create admin accounts, upload malicious files, and essentially take full control of the affected sites,&#8221; warns the WPScan alert.<\/p>\n\n\n\n<p>Researchers have traced the vulnerability back to mid-March 2024. WPScan assigned the flaw a critical rating of 9.9 and assigned it the identifier CVE-2024-27956.<\/p>\n\n\n\n<p>There are also reports of the vulnerability being actively exploited in the wild, with over five million attempted attacks documented so far.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What You Can Do:<\/strong><\/h2>\n\n\n\n<p>If you use the WP-Automatic plugin on your WordPress website, here&#8217;s how to protect yourself:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Update Immediately:<\/strong> The developers of WP-Automatic have released a patched version (3.9.2.1) that addresses the vulnerability. Update your plugin as soon as possible.<\/li>\n\n\n\n<li><strong>Scan for Backdoors:<\/strong> Even if you update now, it&#8217;s crucial to scan your website for any malicious files or backdoors that hackers might have installed during the exploitation window. Security plugins or website security professionals can help with this.<\/li>\n\n\n\n<li><strong>Change Passwords:<\/strong> As an additional precaution, consider changing your WordPress login credentials and any passwords associated with accounts linked to the WP-Automatic plugin.<\/li>\n<\/ul>\n\n\n\n<p>By following these steps, you can significantly reduce the risk of your website being compromised by this critical vulnerability.<\/p>\n\n\n\n<p>This incident highlights the importance of keeping WordPress plugins and themes updated to address security vulnerabilities promptly. It&#8217;s also a good reminder to back up your website regularly so you can restore it in case of a security breach.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress website owners beware! Security researchers have uncovered a critical vulnerability in a widely used plugin that could allow hackers to completely take over websites. The targeted plugin, WP-Automatic, is designed to automate content import and publishing from various sources. &hellip; <a href=\"https:\/\/www.ultimatewb.com\/blog\/4734\/popular-wordpress-plugin-targeted-by-hackers-millions-of-sites-at-risk\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[621],"tags":[2669,629,668,2670,2667,2668,1081,2666],"class_list":["post-4734","post","type-post","status-publish","format-standard","hentry","category-technology-in-the-news","tag-backdroor","tag-hackers","tag-hacking","tag-scan-for-backdoors","tag-sql-injection","tag-sqli-attacks","tag-wordpress-plugin","tag-wp-automatic"],"_links":{"self":[{"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/posts\/4734"}],"collection":[{"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/comments?post=4734"}],"version-history":[{"count":1,"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/posts\/4734\/revisions"}],"predecessor-version":[{"id":4736,"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/posts\/4734\/revisions\/4736"}],"wp:attachment":[{"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/media?parent=4734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/categories?post=4734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ultimatewb.com\/blog\/wp-json\/wp\/v2\/tags?post=4734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}