WordPress Yellow Pencil Plugin Flaws Actively Exploited
Every other WordPress plugin, Yellow Pencil Visual Theme Customizer, is being exploited in the wild after discovering two software vulnerabilities. WordPress plugin maker Yellow Pencil Visual Theme Customizer asks all users to immediately replace it after it was found to have software program vulnerabilities that are being actively exploited. Researchers said the attacker exploiting those flaws has been behind several of the latest plugin attacks in the past few weeks. A visible-design plugin that allows customers to style their websites, Yellow Pencil has an active install base of more than 30,000 websites. However, the plugin changed to finding two software program vulnerabilities that can now be underneath an energetic exploit. In protection on its internet site, Yellow Pencil advised users to restore to the modern model of the plugin, 7.2.0, as soon as viable: “If your website does no longer redirect to the malware internet site, your internet site is not hacked, however you ought to update the plugin quickly to the today’s model for retaining your internet site secure. 7.2.0 version is safe, and all older versions are under change now.”
According to WordPress, the plugin was removed from the repository on Monday and is unavailable for download. A security researcher then “made the irresponsible and dangerous decision to post a blog such as a proof of idea (POC) detailing how to take advantage of a fixed of software program vulnerabilities inside the plugin” – and then the exploits started, Wordfence researchers said. “We are seeing a high quantity of attempts to take advantage of this vulnerability,” researchers with Wordfence said in a Thursday submission outlining the exploits. “Site proprietors jogging the Yellow Pencil Visual Theme Customizer plugin are advised to remove it from their websites immediately.”
Vulnerabilities
Researchers said that one of the flaws inside the plugin is a privilege-escalation vulnerability in its yellow-pencil.Php file. This document has a feature that tests if a particular request parameter (yp_remote_get) has been set – and if it has, the plugin immediately escalates the customers’ privileges to that of an administrator. That method that any unauthenticated user may want to perform site admin moves, like changing arbitrary alternatives or extra.
The 2D flaw is “a pass-site request forgery (CSRF) check is missing within the characteristic below that would have made it a lot tougher to take advantage of,” researchers said. Yellow Pencil longer responded to a request for comment from Threatpost.
Plugin Exploit Specialists?
Researchers with Wordfence stated they are “assured” that the plugin is being exploited by way of the same dangerous actor who has used other plugins – inclusive of Social Warfare and Easy WP SMTP, as well as Yuzo Related Posts, which become additionally determined being utilized this week. The IP deal with the area web hosting the malicious script inside the attacks is identical for the exploits within the different assaults, they said. “We once more see commonalities between these and make the most attempts and assaults on these days determined vulnerabilities in the Social Warfare, Easy WP SMTP, and Yuzo Related Posts plugins,” they said. “We are assured that each one of four assault campaigns is the work of the same dangerous actor.” Don’t omit our unfastened Threatpost webinar, “Data Security within the Cloud,” on April 24 at 2 p.m. ET. A panel of professionals will be a part of Threatpost senior editor Tara Seals to speak about how to lock down facts while the conventional community perimeter is not nearby. They will discuss how the adoption of cloud offerings affords new safety-demanding situations, which include thoughts and excellent practices for locking down this new architecture, whether or not managed or in-house protection is the way to head, and ancillary dimensions, like SD-WAN and IaaS.
