{"id":339184,"date":"2020-02-18T10:40:01","date_gmt":"2020-02-18T08:40:01","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=339184"},"modified":"2020-02-18T10:41:54","modified_gmt":"2020-02-18T08:41:54","slug":"critical-wordpress-plugin-bug-lets-hackers-wipe-thousands-of-websites","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/339184-critical-wordpress-plugin-bug-lets-hackers-wipe-thousands-of-websites.html","title":{"rendered":"Critical WordPress plugin bug lets hackers wipe thousands of websites"},"content":{"rendered":"<p>A serious WordPress plugin vulnerability could allow hackers to wipe information from thousands of sites, according to a <a href=\"https:\/\/www.webarxsecurity.com\/critical-issue-in-themegrill-demo-importer\/\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>report released by WebARX<\/strong><\/a>.<\/p>\n<p>The affected plugin is the ThemeGrill Demo Importer, which is included with commercial themes from website development company ThemeGrill.<\/p>\n<p>The plugin currently has over 200,000 active installations and lets users import demo content, widgets, and theme settings to preview examples of what their web page will look like.<\/p>\n<h3 class=\"my-4\">No authentication needed<\/h3>\n<p>According to WebARX, the exploit allows any unauthenticated user to wipe a site&#8217;s entire database and return it to its default state. Additionally, the user is then automatically logged in as an administrator on the site.<\/p>\n<p>WebARX said that since the exploit does not require any suspicious-looking payload, it is not expected that any firewall will block this by default.<\/p>\n<p>The affected plugin versions run from 1.3.4 to 1.6.1, which means that the vulnerability has been around for three years.<\/p>\n<p>After WebARX released its own patch for the issue to its customers on 6 February, it reported the problem to WordPress.<\/p>\n<p>An <a href=\"https:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=&amp;sfph_mail=&amp;reponame=&amp;new=2245070%40themegrill-demo-importer%2Ftrunk&amp;old=2190304%40themegrill-demo-importer%2Ftrunk&amp;sfp_email=&amp;sfph_mail=\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>update<\/strong><\/a> was subsequently rolled out on 16 February to fix the issue. Users who are running the impacted versions of the plugin are encouraged to install this patch.<\/p>\n<h3 class=\"my-4\">Now read: <a href=\"https:\/\/mybroadband.co.za\/news\/security\/338772-chrome-extensions-leaked-private-data-of-millions-of-users.html\" rel=\"bookmark\">Chrome extensions leaked private data of millions of users<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>A serious WordPress plugin vulnerability could allow hackers to wipe information from thousands of sites, according to a report released by WebARX.<\/p>\n","protected":false},"author":341042,"featured_media":229919,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[63194,62680,9647],"class_list":["post-339184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-themegrill","tag-webarx","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/339184"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341042"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=339184"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/339184\/revisions"}],"predecessor-version":[{"id":339216,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/339184\/revisions\/339216"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/229919"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=339184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=339184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=339184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}