7 February 2017

WordPress vulnerability in REST API is being actively exploited

WordPress vulnerability in REST API is being actively exploited

WordPress vulnerability in REST API is being actively exploited

Attacks against unpatched WordPress websites are seen in the wild.

Website owners started to complain about website hacks just hours after WordPress made publicly available information about content injection vulnerability in REST API (described in security advisory SB2017012702 #4). The vulnerability in question was silently patched in version 4.7.2 and disclosed a couple of days after the rest of vulnerabilities in security advisory.

A lot of people started to criticize WordPress for withholding information about the patch as it raised some privacy concerns. As we can see however it was a correct decision and lots of people were able to patch their WordPress instances before the actual outbreak has started.

Currently we are seeing automated attacks exploiting vulnerability in REST API. The requests to the website look as follows:

1)      The attackers send request to URL:

http://[host]/index.php/wp-json/wp/v2/posts/

2)      Obtain the latest post identifier

3)      Send request to the obtain post identifier and inject the following contents:

Hacked By <Supposedly hackers nickname>

e.g.:

Hacked By BALA SNIPER

or

Hacked By MuhmadEmad

Evidence of hacked websites in .cz domain according to Google:

Hacked By BALA SNIPER 1700
Hacked By MuhmadEmad 1170

 

If you are seeing this page on your website, your website has been compromised. According to Sucuri, this vulnerability can be used to execute arbitrary PHP code if combined with functionality of third-party WordPress plugins. We urge WordPress website owners to install the latest version of WordPress 4.7.2 ASAP.

 

Back to the list

Latest Posts

Week in review: Nicehash security breach and botnet Satori activity

Week in review: Nicehash security breach and botnet Satori activity

The article contains a brief report of cybersecurity incidents for the past week.
11 December 2017
Week in review: major cybersecurity incidents in November 27-December 3

Week in review: major cybersecurity incidents in November 27-December 3

The article contains a brief report of cybersecurity incidents for the past week.
6 December 2017
Week in review: major cybersecurity incidents in November 20-26

Week in review: major cybersecurity incidents in November 20-26

The article contains a brief report of cybersecurity incidents for the past week.
27 November 2017