Warning about an actively exploited vulnerability in a WordPress plugin
The National Cyber Security Center SK-CERT warns about an actively exploited vulnerability in the Beautiful Cookie Consent Banner plugin of the WordPress content management system.
The mentioned plugin is used to create a graphical notification about the use of cookies. The plugin has over 40,000 active installations.
The vulnerability allows for a XSS attack, where an unauthenticated attacker can inject malicious code into the page due to weak security mechanisms. This can lead to a complete compromise of the target system, granting the attacker access to sensitive data and privilege escalation.
The vulnerability has not been assigned a CVE. Its CVSS has been calculated as 7.2. However, the vulnerability is actively exploited by attackers, meaning that they actively attempt to exploit the vulnerability and target websites that use the WordPress content management system with the mentioned plugin.
The company that created and maintains this plugin released a patch for the vulnerability in January 2023. Therefore, the National Cyber Security Center SK-CERT recommends that all users of the mentioned plugin update it to the latest version immediately, especially if they are using version 2.10.1 or lower.
Sources
https://www.wordfence.com/blog/2023/05/wordfence-firewall-blocks-bizarre-large-scale-xss-campaign/
« Späť na zoznam
