50,000 websites hacked through mailpoet wordpress plugin vulnerability

The users of WordPress, a free and open source blogging tool as well as content management system (CMS), that have a popular unpatched wordPress plugin installed are being cautioned to upgrade their sites immediately.

A serious vulnerability in the WordPress plugin, MailPoet, could essentially allows an attacker to inject any file including malware, defacements and spam, whatever they wanted on the server and that too without any authentication. MailPoet, formerly known as Wysija Newsletter, is a WordPress plugin with more than 1.7 million downloads that allows developers running WordPress to send newsletters and manage subscribers within the content management system. Security researchers pointed out the vulnerability to be serious and said that within the last three weeks, over 50,000 websites have been remotely exploited by the cybercriminals to install backdoors targeting the vulnerable MailPoet plugin.

Some of those compromised websites don’t even run WordPress or don’t have MailPoet plugin enabled in it, as the malware can infect any website that resides on the server of a hacked WordPress website, according the researcher.

To be clear, the MailPoet vulnerability is the entry point, it doesn’t mean your website has to have it enabled or that you have it on the website; if it resides on the server, in a neighbouring website, it can still affect your website.

The security firm first reported about the vulnerability on the beginning of this month. The backdoor installed is a very nasty and creates an admin account that gives attackers full administrative control. It also injects backdoor code into all themes and core files. The worst part with this infection is that the malicious code also overwrites valid files, which are very difficult to recover without a good backup in place. It causes many websites to fall over and display the message:

It is imperative you keep updated all the libraries on your server, your CMS (WordPress,etc) and any plugins you have. Also ONLY download plugins and themes from the official sites. If you need any help in updating your site or checking the validity of your plugins just remember OneHourSiteFix is here to help. Just drop us a chat or mail and we will happily help you with this task. Never has the phrase ‘A Stitch In Time Saves Nine’ been more appropriate.

OneHourSiteFix.com
Helping Make Internet A Safer Place!