Top website builder (opens in new tab) WordPress has pushed an urgent update to users with the WooCommerce add-on installed in response to a highly disruptive security vulnerability.
Cybersecurity researchers from GoldNetwork recently discovered a major flaw affecting WooCommerce Payments 4.8.0 and higher. WooCommerce is an open-source ecommerce WordPress plugin designed to service small and medium-sized businesses.
Explaining the bug in more detail, researchers from WordFence (a cybersecurity team focused on WordPress) claim the bug allows threat actors to “impersonate an administrator and completely take over a website without any user interaction or social engineering required.”
Disaster avoided
WooCommerce devs have now released a security update, and the good news (or so it seems right now) is that the Swiss researchers were the first ones to discover the flaw.
“At this time we have no evidence that the vulnerability was exploited beyond identifying it in our own security testing program. We do not believe any store or customer data was compromised as a result of this vulnerability,” BleepingComputer cited Beau Lebens, Head of Engineering at WooCommerce.
“We immediately deactivated the impacted services and mitigated the issue for all websites hosted on WordPress.com, Pressable, and WPVIP.”
If you have a WordPress site with WooCommerce, chances are it’s already been updated: “We shipped a fix and worked with the WordPress.org Plugins Team to auto-update sites running WooCommerce Payments 4.8.0 through 5.6.1 to patched versions. The update is currently being automatically rolled out to as many stores as possible,” Lebens said.
Here are all the vulnerable WooCommerce Payments versions: .8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, and 5.6.2.
If your website is still running any of the above mentioned versions, chances are it still hasn’t been updated. To do so manually, head to your WP Admin dashboard, navigate to Plugins, find WooCommerce Payments, and look for a notification about the vulnerability, as well as the instructions on how to update.
Via: BleepingComputer (opens in new tab)
