WordPress is probably the best known platform for creating websites on the web. Powering about a quarter of all websites, discovered flaws pose vulnerabilities to both the websites and their users.
The discovered flaws allow hackers to compromise WordPress websites through a vulnerability on the core update server. The remote code of execution flaw was found in php webhook within api.wordpress.org that allows developers to supply a hashing algorithm of their choice to verify code updates are legitimate.
Because of the flaw, hackers could also supply their own. But their algorithm uses weak hashing that could be then included as a part of the verification process. This will make a shared key to be more easier to crack by brute force over the course of just a few hours.
Using the exploit, hackers could then send URLs to the WordPress update servers for the website that would be accepted, to the push out to all WordPress websites.
According to its usage and popularity, web-watching service W3techs.com estimated that WordPress represents 27.1 percent of the entire World Wide Web. So by executing their own code once, hackers can compromise millions of websites.
And not just limited to that, hackers that have access to the system, can do a lot more than that.
Once having the backdoor opened or malicious update pushed out, it's possible that hackers could do whatever they like. One of which is to disable the default auto-update setting on WordPress websites, preventing WordPress to fix those compromised websites. As a result, those websites could be under hackers' control for a long time before being discovered.
The weakness is because WordPress only verifies the validity of downloaded files by only checking an MD5 checksum, and not by using a cryptographic signature. The platform trusts all URLs and packages as long as they are supplied by api.wordpress.org.
The last issue comes from PHP itself. For its minimum requirement, WordPress project has chosen to support PHP 5.2.4.
The flaw is considered to come from the WordPress culture itself. WordPress prioritizes adoption rates over better security. For this reason, WordPress sees backward compatibility as a usability problem more than liability.
This particular issue has been reported over three years ago but has been generally ignored. Besides CMS update packages, the flaw also affects WordPress' plugin and theme update process as well.
4 Out Of 12 E-Commerce Plugins Vulnerable
While it has been discovered that WordPress' core has a longtime flaw that has yet to be patched, researchers are also calling into question the safety of some of the top WordPress e-commerce plugins.
In reviewing the top 12 WordPress e-commerce plugins, application security testing firm Checkmarx found four of them to have severe vulnerabilities to XSS (cross-site scripting), SQL injection and file manipulation flaws.
One of the four plugins contained three vulnerabilities, and each of other three plugins contained one.
"If these vulnerabilities are exploited, users of over 135,000 websites could find their personal data, including credit card information, threatened."
