This faulty WordPress plugin could allow hackers to wipe your website, DigiTech Geeks Mobile Computing News

By -
This faulty WordPress plugin could allow hackers to wipe your website

Researchers have uncovered two severe vulnerabilities in the PageLayer WordPress plugin that could allow hackers to hijack websites that employ its design features.

The affected plugin is used to build custom web pages via a simple drag-and-drop mechanism - a boon for users without programming expertise - and is deployed across more than 200,000 websites.

Identified by security firm Wordfence, the two bugs could also be manipulated by cybercriminals to inject rigged code, meddle with existing website content, and even perform a total content erasure.

WordPress plugin bugs

According to the researchers responsible for the discovery, the pair of vulnerabilities stem from unprotected AJAX actions, nonce disclosure, and a lack of measures to safeguard against Cross-Site Request Forgery (CSRF).

Hackers could reportedly exploit these oversights to perform all manner of malicious activities, including creating admin accounts, funnelling visitors to dangerous domains and invading a user’s computer via the web browser. 

“One flaw allowed any authenticated user with subscriber-level and above permissions the ability to update and modify posts with malicious content, amongst many other things,” explained Wordfence.

“A second flaw allowed attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection.”

The security firm disclosed the flaws on April 30 and PageLayer subsequently issued a patch on May 6, with version 1.1.2. However, despite three weeks having passed since the patch was issued, only roughly 85,000 users have updated to the latest version, leaving circa 120,000 still at risk.

To safeguard against site takeover, PageLayer users are advised to update the plugin to the latest version immediately.

Via Bleeping Computer



Click here to read full article.




Download our Android App for all the latest Tech News: Click here to download our DTG Android App
#DigiTechGeeks #DTG

Comments

Post a Comment

Popular posts from this blog

What Is the “System Volume Information” Folder, and Can I Delete It?

By -
Image
What Is the “System Volume Information” Folder, and Can I Delete It? On every Windows drive—even external USB drives—you’ll find a “System Volume Information” folder. You’ll only see it if you have Windows set to  show hidden files and folders , but it’s always there. So what is it for? Why Can’t I Open the Folder? On drives formatted with  the NTFS file system , this folder’s permissions are set to prevent everyone from accessing the folder, even users with Administrator permissions. Double-click the folder and you’ll see an error message saying the “location is not available” and “access is denied.” This is normal. That’s because Windows uses this folder for certain system-level features. The permissions are set to prevent users—and programs without the appropriate permissions—from tampering with the files inside and interfering with important system functions. What Is It For? Among other things, Windows stores  System Restore ...
Read more

The best early January sales and deals for 2020 that are live now , DigiTech Geeks Mobile Computing News

By -
Image
The best early January sales and deals for 2020 that are live now The best early January sales 2020 Jump straight to the New Year deals you want... Phone and tablet deals Wearable deals Computing deals Audio deals Gaming deals TV deals Smart home deals Camera deals Home deals The January sales 2020 have arrived early. Sure, we still need to get through New Year's Eve – and many Boxing Day sales are still going strong – but a wealth of New Year deals have dropped already.  In fact, there are some brilliant offers to be had if you've got a load of Christmas cash and gift cards burning a hole in your pocket – but scouring the sales can be a slog.  Rather than leaving the warmth of your home, or spending hours on the internet while your family are in another room, we've done the hard work for you. We've searched through the most exciting early January sales to bring you the very best New Year deals available now. Below, you'll find the biggest...
Read more

With no good Black Friday iPad deals, it's time to turn to the Android side , DigiTech Geeks Mobile Computing News

By -
Image
With no good Black Friday iPad deals, it's time to turn to the Android side The Black Friday iPad deals are never any good, but in 2021 they've somehow failed to clear that laughably low bar, and we've still been surprised by just how poor the Apple-tablet discounts are this year. Seriously – we're talking just $50 / £50 off super-power iPad Pros , and sometimes no discounts at all on entry-level or Mini tablets – and this outlook very likely won't change for the Cyber Monday iPad deals . If you were wanting to buy a new iPad in the Black Friday sales, it might seem like you're plum out of luck. (Not in the US or UK? Scroll down for deals in your region). It's not all bad news though, not as long as you're willing to try new things (and aren't committed to the Apple ecosystem already). That's because there are a few worthy tablet Black Friday deals on Android slates that make them much, much more tempting than an iPad. Sure, sure, sure: i...
Read more