BLOG

WordPress Security Plugin Vulnerability Affects +1 Million Sites

All-In-One Security (AIOS) WordPress plugin vulnerabilities impact up to +1 million WordPress sites

WordPress security plugin discovered to have two vulnerabilities that could allow a malicious upload, cross-site scripting and allow viewing of contents of arbitrary files.

All-In-One Security (AIOS) WordPress Plugin

The All-In-One Security (AIOS) WordPress plugin, provided by the publishers of UpdraftPlus, offers security and firewall functionality designed to lock out hackers.

It offers log-in security protection that locks out attackers, plagiarism protection, blocks hotlinking, comment spam blocking and a firewall that serves as a defense against hacking threats.

The plugin also enforces proactive security by alerting users to common mistakes like using the “admin” user name.

It’s a comprehensive security suite that’s backed by the makers of Updraft Plus, one of the most trusted WordPress plugin publishers.

These qualities make AIOS highly popular, with over one million WordPress installations.

 

Two Vulnerabilities

The United States government National Vulnerability Database (NVD) published a pair of warnings about two vulnerabilities.

1. Data Sanitization Failure

The first vulnerability is due to a data sanitization failure, specifically a failure to escape log files.

Escaping data is a basic security process that strips any sensitive data from outputs generated by a plugin.

WordPress even has a developer page devoted to the topic, with examples of how to do it and when to do it.

 

2. Directory Traversal Vulnerability

The second vulnerability appears to be a Path Traversal vulnerability.

This vulnerability allows an attacker to exploit a security failure in order to access files that would not ordinarily be accessible.

The non-profit Open Worldwide Application Security Project (OWASP) warns that a successful attack could compromise critical system files.

Both vulnerabilities require that an attacker acquire admin level credentials to exploit the attack, which might make it harder for the attack to happen.

However one expects a security plugin to not have these kinds of preventable vulnerabilities.

Consider Updating the AIOS WordPress Plugin

AIOS released a patch in version 5.1.6 of the plugin. Users may wish to consider updating to at least version 5.1.6, and possibly to the latest version, 5.1.7, which fixes a crash that occurs when the firewall is not set up.