By Wordfence security analysts reported that the total donations of commercial WordPress plugin is influenced by numerous Zero-Day flaws that are being vigorously exploited in threats.
The crucial flaws influenced entire famous versions of the WordPress plugin, containing version 2.0.5, and permit harmful attackers to acquire administrative access to impact WordPress websites. Due to unavailability of response from the developers of the plugin, the clients are considered to entirely eliminate the plugin from their installations. Total Donations is aimed to make the online donations receiving easily and offers the choice to website owners for viewing the progress bars and handle the tasks and campaigns accordingly.
The plugin, Wordfence has discovered, “registers a total of 88 unique AJAX actions into WordPress, each of which can be accessed by unauthenticated users by querying the typical /wp-admin/admin-ajax.php endpoint.”
Moreover, the security analysts detected that forty-nine of these activities can be employed to access sensitive information, make unofficial alterations to the content and configuration of the website, and even entirely take over it as well. Total Donations permits genuine users to read and update absolute WordPress choices, and Wordfence states that harmful attackers are so far attempting the matter in the wild.
The analysts discovered two utilities that can be employed to read the worth of any WordPress choice and numerous operations that can be employed to change the economic values of these alternatives. Two operations can be employed to register new accounts of the users along with administrative advantages on the influenced website.
The analysts also note the total Donations, which can associate to Stripe as a payment processor and can advantage Stripe’s Plans API to list repeating donations. But, the operations employed for the fundamental interaction attribute no access control and can be employed to manipulate with repeating donations. A hacker could merely route incoming donations to a totally assorted Stripe account.
Total Donations besides contain utility to incorporate its own campaigns with mailing lists, however the individual operations fail to execute permissions checks before returning details related with a connected mailing lists of account. The WordPress plugin is influenced by anonymous flaws, permitting unauthenticated access to unpublished and private posts, directing to SQL injection, and letting a hacker to send away test emails to an absolute address automated, this could advance to Denial of Service for outbound email.
Wordfence accumulated CVE-2019-6703 to trail and mention these flaws altogether. The analysts have been endeavoring to contact the developers of the plugin for the previous couple of weeks however received no result. Therefore, the flaws remain non-fixed, despite being vigorously employed.
“It is our recommendation that site owners using Total Donations delete–not just deactivate–the vulnerable plugin as soon as possible to secure their sites. The following article details the issues present in Total Donations, as well as the active attacks against the plugin,” Wordfence says.
