Disgruntled security firm discloses zero-days in Facebook's WordPress plugins

-
Zero-days disclosed in "Facebook for WooCommerce" and "Messenger Customer Chat."
A US-based cyber-security firm has published details about two zero-days that impact two of Facebook's official WordPress plugins.
The details also include proof-of-concept (PoC) code that allows hackers to craft exploits and launch attacks against sites using the two plugins.

Impacted plugins

The two zero-days impact "massengercuttomer chat," a WordPress plugin that shows a custom Messenger chat window on WordPress sites, and "facebook for WooCommerce," a WordPress plugin that allows WordPress site owners to upload their WooCommerce-based stores on their Facebook pages.
The first plugin is installed by over 20,000 sites, while the second has a userbase of 200,000 -- with its statistics exploding since mid-April when the WordPress team decided to start shipping the Facebook for WooCommerce plugin as part of the official WooCommerce online store plugin itself.
Since then, the plugin has garnered a collective rating of 1.5 stars, with the vast majority of reviewers complaining about errors and a lack of updates.

The grudge

Nevertheless, despite the bad reputation, today, the security of all users who installed these extensions was put at risk because of a stupid grudge between a Denver-based company called White Fir Design LLC (dba Plugin Vulnerabilities), and the WordPress forum moderation team.
In a dispute that's been raging for years, the Plugin Vulnerabilities team decided they wouldn't follow a policy change on the WordPress.org forums that banned users from disclosing security flaws through the forums, and instead required security researchers email the WordPress team, which would then contact plugin owners.
For the past years, the Plugin Vulnerabilities team has been disclosing security flaws on the WordPress forums in spite of this rule -- and having its forum accounts banned as a result of their rule-breaking behavior.
Things escalated this past spring when the Plugin Vulnerabilities team decided to take their protest a step further.
Instead of creating topics on the WordPress.org forums to warn users about security flaws, they also started publishing blog posts on their site with in-depth details and PoC code about the vulnerabilities they were finding.

Comments

Post a Comment

Popular posts from this blog

Seo tools /SEO experts actually/backlink.

-
Image
            SEO tools   Everyone knows how powerful social media can be for branding. It is not as simple as it seems to turn your social media users into leads and customers. But using the right tools, you’ll be able to optimize your social media conversions. According to research from  Shareaholic , social media drove almost 31.24 % of overall traffic to websites. Social media is a great place to reach target customers, increase follower counts and build a positive online reputation for online business. There is another side of social media that helps converting social media followers into potential customers and qualified leads. The research from  Monetate  that analyzed more than 500 million shopping experiences revealed that social media is still standing behind when it comes to conversions. It means that social media traffic with an average conversion rate of 0.71% is generally poor in comparison with email’s 3.19 % and searcher’s 1.95%. But it can be better, if you s
Read more

How to your Facebook account save and secure satting protect your privacy on Facebook

-
Image
Worried that Facebook collects too much information on you and makes it too freely available to advertisers and others? You’re not the only one. CEO Mark Zuckerberg insists that Facebook is going to fix its privacy problems, but until it does, there are some things you can do to keep your personal information safe. While there are plenty of ways you can tweak Facebook, here are some basic steps that will go a long way toward protecting your privacy on one of the world’s biggest social media networks. Delete personal information You’ll probably be surprised by how much personal information you’ve put on Facebook over the years, from places you’ve lived and visited to your phone number, birthday, and more. So your first privacy step should be to delete what you don’t want Facebook or other people to know. Switch Off Facial Recognition Facebook has used facial recognition for years to tag your photos. If that makes you uneasy, here’s how to switch it off. On the we
Read more

Bail to bitcoin baiter against 15 lakh deposit

-
Image
In what could be seen as a new trend emerging in the apex court while dealing with economic offenders, the bench allowed bail to an accused in the bitcoin scam on Saturday, in lieu of hefty amounts of cash as a security deposit — Rs 15 lakh, to be precise. The court was hearing the bail petition of Akash Kantilal Sancheti, accused of duping several persons of Rs 42 lakh. The first complaint against him was lodged by a Pune entrepreneur, who claimed she had invested Rs 13 lakh in Sancheti's business since August 2017. He was arrested in January 2018. On Friday, his bail petition came up for hearing before a bench comprising Justices RF Nariman and V Ramasubramanian. His lawyer, senior advocate Siddharth Dave, submitted that Sancheti has been behind bars for 20 months and the kingpin of the scam is already out on bail. The bench directed Sancheti to deposit Rs 13 lakh with the registry of the apex court within six months. In addition, it told him to furnish a bail bond of R
Read more