InfiniteWP Client and WP Time Capsule
Two WordPress plugins, InfiniteWP Client and WP Time Capsule, have been found with vulnerabilities, compromising around 320,000 sites. The report came from WebArx. It revealed that with the two plugins users can manage many WordPress sites and also to back up files and databases. The vulnerabilities allow anyone to log into administrator pages.
The plugin is active on over 300,000 sites and WP Time Capsule on at least 20,000 domains. The vulnerabilities affect all versions of InfiniteWP prior to 1.9.4.5. Attackers can exploit the vulnerability by bypassing the step asking for a password, if they know an administrator’s username.
The InfiniteWP Client plugin is a popular tool for managing multiple WordPress sites from a single location. The vulnerability in this plugin, identified as CVE-2019-9978, is related to the way the plugin handles user authentication. Specifically, the plugin does not properly validate user credentials, which could allow an attacker to gain access to the site’s dashboard without proper authentication.
The WP Time Capsule plugin is a backup and restore tool for WordPress sites. The vulnerability in this plugin, identified as CVE-2019-9979, is related to the way the plugin processes backup files. Specifically, the plugin does not properly validate the contents of backup files before restoring them, which could allow an attacker to inject malicious code into a website.
Both of these vulnerabilities received patches in updates to the affected plugins. It is important for users of these plugins to update to the latest versions to protect their websites from potential attacks. Additionally, it is best keeping up to date all third-party plugins and themes on a website to ensure the overall security of the site.
If you found this article interesting, then you might also enjoy this one.
Author: PC-GR
The World of Technology
