Cybercriminals have been spotted abusing a known, high-severity vulnerability in a popular WordPress plugin, just a day after a proof-of-concept (PoC) exploit was published.
Cybersecurity researchers from PatchStack discovered a cross-site script (XSS) vulnerability in Advanced Custom Fields, a popular plugin for the WordPress website builder (opens in new tab), with more than two million active installs.
The flaw, tracked as CVE-2023-30777, allowed threat actors to steal sensitive data from visitors and, in some cases, take over the website, entirely.
Fast-moving crooks
PatchStack discovered the vulnerability on May 2, and published a report on May 5 together with the PoC. In the meantime Delicious Brains, the plugin’s operators, released a security update, bringing the plugin to version 6.1.6.
Now, crooks are betting on most website administrators not yet having updated their virtual real estate, which would make their website vulnerable to this 6.1/10 flaw.
“The Akamai SIG analyzed XSS attack data and identified attacks starting within 24 hours of the exploit PoC being made public,” the company’s report claims. “What is particularly interesting about this is the query itself: The threat actor copied and used the Patchstack sample code from the write-up.”
Official WordPress.org stats state that fewer than a third of all users (31.7%) updated the plugin to the 6.1. version, meaning hackers have quite a few websites to attack. BleepingComputer’s report states that at least 1.4 million sites are still vulnerable to this XSS flaw.
“This vulnerability allows any unauthenticated user [to steal] sensitive information to, in this case, privilege escalation on the WordPress site by tricking the privileged user to visit the crafted URL path,” Patchstack said. “This vulnerability could be triggered on a default installation or configuration of Advanced Custom Fields plugin. The XSS also could only be triggered from logged-in users that have access to the Advanced Custom Fields plugin,” the researchers concluded.
This is the fourth major vulnerability to be found in this plugin in the last couple of years.
Via: BleepingComputer (opens in new tab)
