Wordfence just launched its bug bounty program.
On December 5th, 2023, shortly after the launch of our Holiday Bug Extravaganza, we received a submission for a PHP Code Injection vulnerability in Backup Migration, a WordPress plugin with over 90,000+ active installations.
This vulnerability makes it possible for unauthenticated threat actors to inject and execute arbitrary PHP code on WordPress sites that use this plugin.
We quickly released a firewall rule to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers on December 6, 2023.
Sites still running the free version of Wordfence will receive the same protection 30 days later, on January 5, 2024.
We contacted the BackupBliss team, makers of the Backup Migration plugin, on the same day we released our firewall rule.
We urge users to update their sites with the latest patched version of Backup Migration, which is version 1.3.8 at the time of this writing, immediately.
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.
This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution.
This makes it possible for unauthenticated threat actors to easily execute code on the server.
Php file used by the Backup Migration plugin attempts to include bypasser.
December 6, 2023 - We initiate contact with the plugin developer and send over the full disclosure details.
A fully patched version of the plugin, 1.3.8, is released.
In this blog post, we detailed a critical PHP Code Injection vulnerability within the Backup Migration plugin affecting versions 1.3.7 and earlier.
This vulnerability allows unauthenticated threat actors to inject arbitrary PHP code, resulting in a full site compromise.
The vulnerability has been fully addressed in version 1.3.8 of the plugin.
We urge WordPress users to verify that their sites are updated to the latest patched version of Backup Migration.
Wordfence users running Wordfence Premium, Wordfence Care, and Wordfence Response have been protected against these vulnerabilities as of December 6, 2023.
Users still using the free version of Wordfence will receive the same protection on January 5, 2024.
If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.
This Cyber News was published on www.wordfence.com. Publication date: Mon, 11 Dec 2023 19:13:05 +0000