WordPress Vulnerability Lets Cybercriminals Insert JavaScript Code via Comments Field

You’d think its users would deserve a break at this point, but the discovery of another WordPress vulnerability suggests site owners should be on the lookout for a zero-day flaw that could lead to cross-site scripting attacks.

First disclosed by a security researcher based in Finland, the latest WordPress vulnerability involves a bug that could let cybercriminals inject JavaScript code into the comments field of a site. If a WordPress site administrator approves the comment, which must be 66,000 characters long, it only needs to be viewed once before the code is executed, allowing cybercriminals to take over passwords and admin controls. The vulnerability affects Version 4.2 of the blogging and website platform.

Attackers have tried similar tactics before, and despite the popularity of WordPress, the company behind it hasn’t always been quick to respond. Just a few days ago, a patch was made available for a similar WordPress vulnerability discovered more than a year ago, ThreatPost reported, though in that case, the comment required special characters to execute an attack.

Though a watchful admin could theoretically not approve suspicious comments, there are social engineering techniques to get around such limitations, a story on Ars Technia pointed out. For example, if a clever cybercriminal posted a legitimate comment that was approved, subsequent comments containing the WordPress vulnerability would automatically go live on a site. Then, all it takes is theme editors or plugin tools to let the code injection do its work.

A security researcher confirmed to Forbes that the WordPress vulnerability is a real danger, and though the company said it will offer a patch, there is no real sense of when it will be released. That may lead many site editors to disable comments or at least use plugin tools such as Akismet to minimize the risks.

Chief information security officers and members of IT teams can be forgiven if it is becoming difficult to keep up with every new WordPress vulnerability. Earlier this month, a flaw in a popular plugin called Super Cache left an estimated 1 million sites at risk, while an earlier issue with a plugin used in many WordPress themes was enabling local file inclusion attacks.

Image Source: iStock

Shane Schick

Writer & Editor

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

What we can learn from the best collegiate cyber defenders

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

New proposed federal data privacy law suggests big changes

Topic updates