Flaws in Two WordPress Plugins can lead to wiping your Database; Over 200,000 websites in danger
WordPress is a very popular content management system and about 75 million websites run on it. WordPress has 55,000+ WordPress plugins present in the official WordPress repository, and about 50,000 more just outside it.
Elementor Pro and ThemeGrill Demo Importer, Both are kind of similar site builder that allows users to add modules and customize their site using a drag and drop builder. They have over 200,000 active websites using them.
However, recently it has been found that both the plugins are vulnerable to a bug that can be exploited remotely by attackers to upload arbitrary files resulting in the execution of unauthorized code which can be very harmful.
A researcher found that “there is a vulnerability that allows an unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator”
“In order to be automatically logged in as an administrator, there must be a user called ‘admin’ in the database. Regardless of this condition, the database will still be wiped to its default state,” the researcher added.
According to the reports, it seems that the vulnerability only occurs when the plugin is activated. WebARX said that it discovered and reported the latest security hole to the tool’s developer on February 6. The fix was eventually supplied with the plugin’s version 1.6.2 on February 15. As a result, users are advised to ensure that they run either this version or version 1.6.3, which was rolled out earlier today.
In addition, since many hacks originate from compromised login credentials, make sure your password or passphrase is strong and unique and that, wherever available, you use two-factor authentication for extra security.