Be careful which websites you visit now! A serious security flaw has been discovered in sites running WordPress, the famous content management system. 200,000 sites would thus be infected by malware.
It’s not just operating systems and applications that are affected by security vulnerabilities. The software used to create sites is also. This is particularly the case of WordPress, the famous CMS (content management system or content management system, in French) which serves as a “shell” for a multitude of amateur and professional sites around the world. Indeed, security experts from Wordfence have just discovered that MW WP Form, an add-on (plug-in) for WordPress, had a very annoying vulnerability that allowed hackers to introduce dangerous malware. The problem is that this extension is very popular since it allows site managers to easily create forms and insert them into web pages. This is not very reassuring news since MW WP Form is designed to collect visitors’ personal data (email address, name, etc.). A blessing for hackers, especially since the number of sites using this plug-in is impressive!
WordPress vulnerability: nearly 200,000 sites infected by malware
The problem is that MW WP Form does not just collect textual information in forms: the extension can also retrieve files and save them to a database stored on a server associated with the website. Of course, the plug-in includes a device that analyzes the files submitted to it and deletes any unauthorized files it detects. But after careful examination of the code, Wordfence researchers noted that, even when it detected a dangerous file, MW WP Form saved it when the “Save request data in database” option was activated in the form parameters. As was to be feared, cybercriminals have noticed this flaw. And they took the opportunity to upload corrupted data to sites and servers, including PHP scripts allowing them to activate code remotely.
According to Wordfence experts, who classified this flaw as critical with a score of 9.8 out of 10, nearly 200,000 websites have been affected by malware, which could cause numerous victims among Internet users who consult them. . Of course, Wordfence warned the MW WP Form editor, who immediately corrected the problem in a new version of the plug-in, 5.0.2. But it will probably take a little while before all WordPress site owners integrate it. In the meantime, and to avoid any risk, when you arrive at a website, make sure that it is not built with WordPress: the mention is often indicated at the bottom of the home page, among other information.