![\"The](\"https:\/\/images.news18.com\/ibnlive\/uploads\/2021\/07\/1627283897_news18_logo-1200x800.jpg?impolicy=website&width=510&height=356\" "\\"The"){kind=logo}
<\/figure>\nThe bug is present in the Ultimate Member plugin<\/p>\n<\/div>\n
In response to the vulnerability report, the creators of the plugin promptly released a new version, 2.6.4, intending to fix the problem.
\n
\n<\/h2>\n<\/div>\n<\/div>\n\n\nMore than 2 lakh WordPress websites are at the hacking risk due to a critical unpatched security vulnerability that was being actively exploited by malicious actors.<\/p>\n
According to WordPress security firm WPScan, the bug is present in the Ultimate Member plugin, which is a free user profile WordPress plugin that makes it easy to create powerful online communities and membership sites with WordPress.<\/p>\n
\u201cThis is a very serious issue as unauthenticated attackers may exploit this vulnerability to create new user accounts with administrative privileges, giving them the power to take complete control of affected sites,” the security firm warned.<\/p>\n
There was \u201cno complete fix to this issue” and worryingly, \u201cthere were indications that this issue was being actively exploited by malicious actors,” the firm added.<\/p>\n
In response to the vulnerability report, the creators of the plugin promptly released a new version, 2.6.4, intending to fix the problem.<\/p>\n
\u201cHowever, upon investigating this update, we found numerous methods to circumvent the proposed patch, implying the issue is still fully exploitable,” the WPScan team noted.<\/p>\n
<\/p>\nThe plugin operates by using a pre-defined list of user metadata keys that users should not manipulate.<\/p>\n
It uses this list to check if users are attempting to register these keys when creating an account.<\/p>\n
\u201cUnfortunately, differences in how the Ultimate Member\u2019s blocklist logic and how WordPress treats metadata keys made it possible for attackers to trick the plugin into updating some it shouldn\u2019t,” said the team.<\/p>\n
The security researchers recommend that the users should disable the Ultimate Member plugin until a patch that completely remediates this security issue is made available.<\/p>\n
Sites on WP.cloud hosts, such as WordPress.com and Pressable.com, have received a platform-level patch to help mitigate the vulnerability.<\/p>\n
(This story has not been edited by News18 staff and is published from a syndicated news agency feed – IANS<\/a>)<\/i> <\/div>\n\n\n\n![\"\"\/](\"https:\/\/images.news18.com\/ibnlive\/uploads\/2023\/01\/bharat.jpeg?impolicy=website&width=70&height=70\")
<\/div>\nBharat Upadhyay<\/span><\/a><\/p>\nBharat Upadhyay, Senior Sub-Editor at News18 Tech, writes about technology and consumer gadgets. He has been covering the technology beat for over six…Read More<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n[ad_2]
\n
Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"[ad_1] The bug is present in the Ultimate Member plugin In response to the vulnerability report, the creators of the plugin promptly released a new version, 2.6.4, intending to fix the problem.
More than 2 lakh WordPress websites are at the hacking risk due to a critical unpatched security vulnerability that was being actively … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":3363,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[107],"tags":[],"class_list":["post-4768","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech"],"_links":{"self":[{"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/posts\/4768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4768"}],"version-history":[{"count":0,"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/posts\/4768\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/media\/3363"}],"wp:attachment":[{"href":"https:\/\/bscrackers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
More than 2 lakh WordPress websites are at the hacking risk due to a critical unpatched security vulnerability that was being actively exploited by malicious actors.<\/p>\n
According to WordPress security firm WPScan, the bug is present in the Ultimate Member plugin, which is a free user profile WordPress plugin that makes it easy to create powerful online communities and membership sites with WordPress.<\/p>\n
\u201cThis is a very serious issue as unauthenticated attackers may exploit this vulnerability to create new user accounts with administrative privileges, giving them the power to take complete control of affected sites,” the security firm warned.<\/p>\n
There was \u201cno complete fix to this issue” and worryingly, \u201cthere were indications that this issue was being actively exploited by malicious actors,” the firm added.<\/p>\n
In response to the vulnerability report, the creators of the plugin promptly released a new version, 2.6.4, intending to fix the problem.<\/p>\n
\u201cHowever, upon investigating this update, we found numerous methods to circumvent the proposed patch, implying the issue is still fully exploitable,” the WPScan team noted.<\/p>\n
The plugin operates by using a pre-defined list of user metadata keys that users should not manipulate.<\/p>\n It uses this list to check if users are attempting to register these keys when creating an account.<\/p>\n \u201cUnfortunately, differences in how the Ultimate Member\u2019s blocklist logic and how WordPress treats metadata keys made it possible for attackers to trick the plugin into updating some it shouldn\u2019t,” said the team.<\/p>\n The security researchers recommend that the users should disable the Ultimate Member plugin until a patch that completely remediates this security issue is made available.<\/p>\n Sites on WP.cloud hosts, such as WordPress.com and Pressable.com, have received a platform-level patch to help mitigate the vulnerability.<\/p>\n (This story has not been edited by News18 staff and is published from a syndicated news agency feed – IANS<\/a>)<\/i> <\/div>\n [ad_2] [ad_1] The bug is present in the Ultimate Member plugin In response to the vulnerability report, the creators of the plugin promptly released a new version, 2.6.4, intending to fix the problem.
More than 2 lakh WordPress websites are at the hacking risk due to a critical unpatched security vulnerability that was being actively … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":3363,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[107],"tags":[],"class_list":["post-4768","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech"],"_links":{"self":[{"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/posts\/4768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4768"}],"version-history":[{"count":0,"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/posts\/4768\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=\/wp\/v2\/media\/3363"}],"wp:attachment":[{"href":"https:\/\/bscrackers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bscrackers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/div>\n
\n
Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"