WordPress Yellow Pencil Plugin Flaws Actively Exploited
Every other WordPress plugin, Yellow Pencil Visual Theme Customizer, is being exploited inside the wild after two software vulnerabilities had been discovered. The maker of a WordPress plugin, Yellow Pencil Visual Theme Customizer, asks all users to immediately replace it after it was discovered to have software program vulnerabilities that are being actively exploited. The attacker exploiting those flaws has been behind several different latest plugin attacks those past few weeks, researchers said. A visible-design plugin that allows customers to style their websites, Yellow Pencil has an active install base of greater than 30,000 websites. However, the plugin changed into finding two software program vulnerabilities that can now be underneath an energetic exploit.
In protection replace on its internet site, Yellow Pencil advised users to restore to the modern model of the plugin, 7.2.0, as soon as viable: “If your website does no longer redirect to the malware internet site, your internet site is not hacked however you ought to update the plugin quickly to the today’s model for retaining your internet site secure. 7.2.0 version is safe, and all older versions are under chance now.”
According to WordPress, the plugin was removed from the plugin repository on Monday and is not available for download. A security researcher then “made the irresponsible and dangerous decision to post a blog put up such as a proof of idea (POC) detailing how to take advantage of a fixed of software program vulnerabilities present inside the plugin” – and then the exploits started, Wordfence researchers said. “We are seeing a high quantity of attempts to take advantage of this vulnerability,” researchers with Wordfence said in a Thursday submit outlining the exploits. “Site proprietors jogging the Yellow Pencil Visual Theme Customizer plugin are advised to take away it from their web sites without delay.”
Vulnerabilities
Researchers said that one of the flaws inside the plugin is a privilege-escalation vulnerability that exists in its yellow-pencil.Php file. This document has a feature that tests if a particular request parameter (yp_remote_get) has been set – and if it has, the plugin right away escalates the customers’ privileges to that of an administrator. That method that any unauthenticated user may want to perform site admin moves, like changing arbitrary alternatives or extra.
The 2d flaw is “a pass-site request forgery (CSRF) check is missing within the characteristic below that would have made it a lot greater tough to take advantage of,” researchers said. Yellow Pencil did no longer respond to a request for also comment from Threatpost.
Plugin Exploit Specialists?
Researchers with Wordfence stated they are “assured” that the plugin is being exploited by way of the same danger actor who has used other plugins – inclusive of Social Warfare and Easy WP SMTP, as well as Yuzo Related Posts, which become additionally determined being utilized this week. The IP deal with the area web hosting the malicious script inside the attacks is identical for the exploits within the different assaults, they said.
“We once more see commonalities between these make the most tries and assaults on these days determined vulnerabilities in the Social Warfare, Easy WP SMTP and Yuzo Related Posts plugins,” they said. “We are assured that each one four assault campaigns are the work of the same danger actor.”Don’t omit our unfastened Threatpost webinar, “Data Security within the Cloud,” on April 24 at 2 p.M. ET. A panel of professionals will be a part of Threatpost senior editor Tara Seals to speak about the way to lock down facts while the conventional community perimeter is now not in the vicinity. They will discuss how the adoption of cloud offerings affords new safety demanding situations, which include thoughts and excellent practices for locking down this new architecture; whether or not managed or in-house protection is the way to head; and ancillary dimensions, like SD-WAN and IaaS.
