Another major WordPress plugin was found vulnerable to a high-severity flaw which allowed malicious actors to steal sensitive information from the website, including password hashes.
LayerSlider has published a new security advisory, saying the product is now in version 7.10.1, but adding, “This update includes important security fixes.”
While the announcement does not detail the vulnerability fixed, The Hacker News reported that the project fixed an SQL injection vulnerability impacting versions 7.9.11 through 7.10.0. This vulnerability is now tracked as CVE-2024-2879, and has a severity score of 9.8 (critical).
Targeting WordPress
On its website, LayerSlider describes itself as a “visual web content editor, a graphic design software, and a digital visual effects application all in one”. It also claims to be used by “millions” of people worldwide. LayerSlider is a commercial WordPress plugin, with annual license packages ranging from $26 to $159.
Being the world’s most popular website builder, and used by roughly half of all the websites in existence, WordPress is a major target for cybercriminals everywhere. However, with the platform generally considered safe, hackers have turned their attention to third-party themes and plugins, as these are rarely as secure as the platform itself.
There are thousands of themes and plugins for WordPress, all of which build upon and improve the WordPress experience. Some are free to use, but commercial ones usually have a dedicated team that works on improvements and security. As a result, most of the time, hackers will go for free-to-use themes and plugins – many have millions of users, but have been abandoned by their developers and contain vulnerabilities that are never (or rarely) addressed.
To remain secure, admins should only install themes and plugins they intend on using, and make sure they are always updated to the latest version.