Important Vulnerability on Advanced Custom Fields Plugin for WordPress

Attention WordPress enthusiasts! The much-anticipated WordCamp Phoenix 2024 is just around the corner, and it’s shaping up to be an event you won’t want to miss. Scheduled for February 9-10 at Phoenix College in Arizona, this event promises to be a melting pot of ideas, innovations, and insights in the world of WordPress.

One of the easiest ways to attack a web site is to gain entry through a content management system, such as WordPress. To do this, hackers try to force a login to a site’s WordPress installation using frequently used passwords. These sorts of attacks are known as brute-force attacks. Additionally, read our website hosting security and WordPress Security article and learn how to keep your website secure.

The WordPress content management system or (CMS) is one of the most popular web applications on the market. It’s estimated that WordPress powers almost 43% of the internet, up from 30% just a few years ago. The foundation for the content management system’s success is its convenience, simple installation, and vast theme and plugin community. WordPress can be used by someone who has very little knowledge of the ways a web application functions, but it comes at the expense of security. The article covers the following topics:

The recent cyber attack found by Patchstack researcher Rafie Muhammad on the "Advanced Custom Fields" plugin for WordPress is a stark reminder of how vulnerable websites can be to hackers. In this case, over two million users were at risk of cyberattacks due to a vulnerability (a flaw, tracked as CVE-2023-30777) that allowed miscreants to inject malicious code into webpages and potentially hijack administrative accounts.

As a website owner, you understand the importance of keeping your site secure from the constantly growing cyber threats that lurk in the digital realm. While WordPress security plugins can offer some protection, they often fall short when compared to full-system security software. In this blog post, we'll delve into the limitations of WordPress security plugins and explain what you should look for in a security solution. 

The recent news about the security incident at GoDaddy is not limited to GoDaddy. The attack is multi-year and affects hundreds of thousands, or even millions, of accounts across multiple hosting providers. The criminals are deploying redirects and other malicious payloads. We at Imunify have observed and combated this widespread issue and have been addressing it through our Imunify360 security solution.

As part of Imunify360’s proactive malware research activities, we recently identified that a plugin named Adicionar Banco Inter ao WooCommerce from WordPress repository, which can be used to identify malware in web servers, indeed had active malware inside one of the plugin’s source files.

Today websites are essential for business and operations. To make web design more efficient with added website functionality, web designers use various Plugins. Plugins are the building blocks of a website - they are the little programs that perform a definitive task - based on the needs and personalized requirements of the website owner. It is a lot like providing additional add-ons to the website. Additionally, check our WordPress Security Ultimate Guide for 2021 to learn more about WordPress Security.

As of writing this article, there are more than 52,000 plugins on the market. There are free to use and commercial plugins available from third-party companies and developers. There are also Nulled Plugins which are pirated copies of legitimate versions of different premium plugins, nulled plugins act as a backdoor for many harmful activities. In this article, Krithika Rajendran, malware analyst at Imunify Security will go over the behavior of wp-sleeps and will tell more how to keep your servers protected.

The high severity vulnerability in Post Grid WordPress plugin that appeared in public resources is suspected to be the cause of attackers’ interest to exploit the affected systems.

The discovered vulnerability allows an attacker to forge the template with further inclusion of its code to the application's backend with the ability to perform malicious actions involving privileged users. This could end up with a stolen administrator session or malware injection.

On Wednesday, 2 September, the Imunify360 Web Protection Team detected a significant rise in blocked malware that day. Most of the malware was located in the /wp-file-manager/lib/files/ directory path.

When we investigated, we determined that there was a critical vulnerability in the File Manager plugin for WordPress, and that this vulnerability affected a variety of applications.