Important Vulnerability on Advanced Custom Fields Plugin for WordPress

An attacker gets in through a vulnerable plugin. They drop a backdoor file in wp-content/uploads. In the same session, they write a redirect script into wp_options and a spam link into wp_posts.post_content. A file scanner finds the backdoor. The database UPDATEs stay. The site gets cleaned and still serves pharma spam to search engines the next morning.

WordPress now powers more than half of the web, making it the world’s most popular CMS by a country mile. That dominance has fueled the growth of WordPress-managed hosting, as it’s built to handle performance, updates, and backups. It means businesses don’t have to have so much technical talent to manage their sites.

Earlier this month, we introduced the Imunify Security WordPress Plugin — designed to make the powerful protection of Imunify360 visible right inside the WordPress Admin Dashboard.

If your customers don’t see the security you provide — do they know it’s even there? That’s the challenge we set out to solve with the new Imunify Security WordPress Plugin.