ThemeGrill Demo Importer Vulnerability Actively Exploited in the Wild
Severe vulnerability in ThemeGrill Demo Importer WordPress plugin is being actively exploited in the wild. Users should upgrade to version 1.6.3 ASAP.
Contexto
The ThemeGrill Demo Importer WordPress plugin allows users to import ThemeGrill theme demos in one click. Versions 1.3.4 to 1.6.2 are vulnerable to a remote unauthenticated database wipe and authorization bypass vulnerability. Users are encouraged to upgrade to version 1.6.3 as active attacks have been reported in the wild against users on 1.6.2 and below.
Análise
On February 15, WebARX disclosed a vulnerability in the ThemeGrill Demo Importer for WordPress, which could allow an unauthenticated, remote attacker to execute administrator functions, including reverting all the site’s settings back to their default configuration and wiping all the database tables.
To exploit this vulnerability, a ThemeGrill theme must be installed and activated on a site. If there is an administrative user with the username ‘admin,’ then an attacker will also be automatically logged in as ‘admin’ after the site is wiped.
Prova de conceito
There is no public proof of concept (PoC) available at this time, but attacks have been reported by WebARX, and a list of known malicious IPs can be found at the bottom of the WebARX disclosure page.
Vendor response
On February 16, ThemeGrill released 1.6.2 to address this vulnerability. However, ThemeGrill released version 1.6.3 on February 18 to address issues with the initial fix. Version 1.6.3 removes the automatic invocation of a full reset, and instead directs the user to the plugin’s reset wizard. This comes after reports that users on version 1.6.2 were still being exploited.
Solução
At the time of publication, there is no known effective workaround that would not disrupt functionality of the plugin. Users are encouraged to upgrade to version 1.6.3 of the plugin for mitigation.
Identificação de sistemas afetados
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Obtenha mais informações
- ThemeGrill Demo Importer WordPress Plugin Page
- WebARX Disclosure Page
- ThemeGrill Demo Importer 1.6.3 Source Changes
Junte-se à equipe de resposta de segurança da Tenable na Tenable.
Saiba mais sobre a Tenable, a primeira plataforma de Cyber Exposure para o gerenciamento holístico da sua superfície de ataque moderna.
Obtenha uma avaliação gratuita por 30 dias do Vulnerability Management da Tenable.io.
Artigos relacionados
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Cybersecurity Snapshot: U.S. Gov’t Unpacks AI Threat to Banks, as NCSC Urges OT Teams to Protect Cloud SCADA Systems
March 29, 2024Check out new guidance for banks on combating AI-boosted fraud. Plus, how to cut cyber risk when migrating SCADA systems to the cloud. Meanwhile, why CISA is fed up with SQLi flaws. And best practices to prevent and respond to DDoS attacks. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
Oracle April 2024 Critical Patch Update Addresses 239 CVEs
April 17, 2024Oracle addresses 239 CVEs in its second quarterly update of 2024 with 441 patches, including 38 critical updates.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
- Vulnerability Management