The team behind on the All in One SEO Pack just released a new version of their popular WordPress plugin.
It is a security release patching two privilege escalation vulnerabilities we discovered earlier this week that may affect any web site running it.
While auditing their code, we found two security flaws that allows an attacker to conduct privilege escalation and cross site scripting (XSS) attacks.
In the first case, a logged-in user, without possessing any kind of administrative privileges (like an author of subscriber), could add or modify certain parameters used by the plugin. It includes the post’s SEO title, description and keyword meta tags. All of which could decrease one’s website’s Search Engine Results Page (SERP) ranking if used maliciously.
While it does not necessarily look that bad at first (yes, SERP rank loss is no good, but no one’s hurt at this point, right?), we also discovered this bug can be used with another vulnerability to execute malicious Javascript code on an administrator’s control panel. Now, this means that an attacker could potentially inject any javascript code and do things like changing the admin’s account password to leaving some backdoor in your website’s files in order to conduct even more “evil” activities later.
To be safe make sure you go to the plugin details page to ensure you have the most current version installed.
It is a security release patching two privilege escalation vulnerabilities we discovered earlier this week that may affect any web site running it.
What is Risks?
If your site has subscribers, authors and non-admin users logging in to wp-admin, you are a risk. If you have open registration, you are at risk, so you have to update the plugin now.While auditing their code, we found two security flaws that allows an attacker to conduct privilege escalation and cross site scripting (XSS) attacks.
In the first case, a logged-in user, without possessing any kind of administrative privileges (like an author of subscriber), could add or modify certain parameters used by the plugin. It includes the post’s SEO title, description and keyword meta tags. All of which could decrease one’s website’s Search Engine Results Page (SERP) ranking if used maliciously.
While it does not necessarily look that bad at first (yes, SERP rank loss is no good, but no one’s hurt at this point, right?), we also discovered this bug can be used with another vulnerability to execute malicious Javascript code on an administrator’s control panel. Now, this means that an attacker could potentially inject any javascript code and do things like changing the admin’s account password to leaving some backdoor in your website’s files in order to conduct even more “evil” activities later.
How to Prevent it?
We’re not going to reinvent the wheel on this one: just upgrade to the latest version available for this plugin.How to Upgrade All in One SEO Pack?
If you want to upgrade it, follow below steps- Sign into your WordPress admin panel
- select plugins
- Chose the All in One plugin
- Go to the dropdown at the top or bottom of the page and
- pick "update" If there is an update in the repository the system will check and update it for you.
To be safe make sure you go to the plugin details page to ensure you have the most current version installed.
0 comments:
Post a Comment
You may use these HTML tags and attributes: <a href="" title=""> </a> <b> </b><strong> </strong>