If your website is Watch Private Obsession (1995) full moviepowered by the WordPress page-builder Elementor, double-check if you're using this popular plugin. Because, if you are, hackers can easily stage a complete takeover of your website thanks to a newly discovered security flaw.
Security researchers at Patchstack have released a new reportabout a concerning cybersecurity issue related to the WordPress plugin Essential Addons for Elementor. The plugin provides users with an assortment of pre-built WordPress blocks and templates for use when creating or updating their website.
"This plugin suffers from an unauthenticated privilege escalation vulnerability and allows any unauthenticated user to escalate their privilege to that of any user on the WordPress site," writes Patchstack in its report.
Basically, malicious actors can take advantage of this to reset the password of any user, including the administrator's account. If that latter account's password is reset, a hacker could basically have access to the entire website – backend and all – and take control of the site from its rightful owner. If a targeted website stores user information, this bad actor would have access to and control of that as well.
"This vulnerability occurs because this password reset function does not validate a password reset key and instead directly changes the password of the given user," explains Patchstack.
The plugin vulnerability has since been patched and Essential Addons for Elementor users are being urged to update to version 5.7.2. All versions of the plugin prior, going back to version 5.4.0, are affected by the vulnerability. So, be sure to update the plugin!
More than 43 percentof all of the websites on the internet use WordPress. Elementor is a popular website builder for WordPress-powered sites. More than 12 millionWordPress-sites utilize Elementor. According to the WordPress Plugin Directory, more than 1 millionactive websites have the Essential Addons for Elementor installed.
Topics Cybersecurity
(Editor: {typename type="name"/})
The 10 Most Anticipated PC Games of 2017
Blac Chyna's lawyer says she'll seek restraining orders against Rob Kardashian
Everything coming to Amazon Prime Video in September 2020
Trump at the G20 summit was pretty much a gaffe
NYT Connections Sports Edition hints and answers for April 17: Tips to solve Connections #206
It took less than a week for Nevada to start running out of legal marijuana
Photos: The 2020 March on Washington
TikTok wants me to host a dinner party. Is that an actual recession indicator?
Australian journalist behind scathing Trump takedown is sticking to his guns
接受PR>=1、BR>=1,流量相当,内容相关类链接。