A critical privilege-escalation vulnerability could lead to backdoors for admin access nesting in web servers.
A critical vulnerability has been discovered in the popular WordPress SEO plugin All in One SEO. As per WordPress stats, this plugin is used by more than 3 millions websites. If it is not patched by the website owners, it can cause the serious problem for the website owners.
Security Risk: High
Exploitation Level: Easy
CVSS Score: 9.9 / 7.7
Vulnerability: Privilege Escalation, SQL Injection
Patched Version: 4.1.5.3If you are using All in One SEO WordPress plugin, make sure that you upgraded it to latest version 4.1.5.3 to secure your website. If it is not upgraded, it can cause serious problem for your website.
An attacker with an account with the site – such as a subscriber, shopping account holder or member – can take advantage of the holes, which are a privilege-escalation bug and an SQL-injection problem, according to researchers at Sucuri.
By default, new accounts are ranked as subscriber and do not have any privileges other than writing comments. However, certain vulnerabilities, such as the ones just discovered, allow these subscriber users to have vastly more privileges than they were intend.
Popular WordPress plugins are now being targeted for such vulnerabilities. In last couple of months, many popular WordPress plugins were patched to address critical privilege escalation, XSS, SQL injection etc. vulnerabilities. For WordPress users, you should keep your installation up to date to avoid any impact.
I’m glad to receive the information. It shows how much you’re concerned about user’s welfare, and I’m grateful!
Hoping to have my site secured after upgrading it to the latest version. I’m also hopeful that other users get to see the information and react fast.