Drygt 1.6 miljoner WordPress-sajter attackeras just nu i försök att exploatera nya buggar i flera populära teman och i en rad likaledes populära plugins.

Det är säkerhetsföretaget WordFence som varnar att bara de senaste dagarna så har över 13.7 miljoner attacker stoppats och blockerats.

Today, on December 9, 2021, our Threat Intelligence team noticed a drastic uptick in attacks targeting vulnerabilities that make it possible for attackers to update arbitrary options on vulnerable sites. This led us into an investigation which uncovered an active attack targeting over a million WordPress sites. Over the past 36 hours, the Wordfence network has blocked over 13.7 million attacks targeting four different plugins and several Epsilon Framework themes across over 1.6 million sites and originating from over 16,000 different IP addresses.

Wordfence Premium Users are protected against any exploit attempts targeting all of these vulnerabilities. Wordfence free users are protected against attacks targeting all of the vulnerabilities except for the recently disclosed vulnerability in PublishPress Capabilities. Wordfence Premium users received a firewall rule for the Unauthenticated Arbitrary Options Update vulnerability in PublishPress Capabilities on December 6th, 2021, and sites still running the free version of Wordfence will receive the firewall rule on January 6, 2022.

Wordfence

Buggarna finns i:

• Kiwi Social Share (<= 2.0.10),
• WordPress Automatic (<= 3.53.2)
• Pinterest Automatic (<= 4.14.3)
• PublishPress Capabilities (<= 2.3)

 

Teman

Det är populära plugins som finns installerade i ett mycket stort antal webbplatser runt om i världen. Förutom buggar i plugins finns också buggar, säkerhetshål i flera populära teman för WordPress.

• Activello (<=1.4.1)
• Affluent (<1.1.0)
• Allegiant (<=1.2.5)
• Antreas (<=1.0.6)
• Bonkers (<=1.0.5)
• Brilliance (<=1.2.9)
• Illdy (<=2.1.6)
• MedZone Lite (<=1.2.5)
• NatureMag Lite (no known patch available)
• NewsMag (<=2.4.1)
• Newspaper X (<=1.3.1)
• Pixova Lite (<=2.0.6)
• Regina Lite (<=2.0.5)
• Shapely (<=1.2.8)
• Transcend (<=1.1.9)

IP-nummer

Wordfence har hittat flera IP-nummer som återkommer i attackerna:

• 144.91.111.6 with 430,067 attacks blocked.
• 185.9.156.158 with 277,111 attacks blocked.
• 195.2.76.246 with 274,574 attacks blocked.
• 37.187.137.177 with 216,888 attacks blocked.
• 51.75.123.243 with 205,143 attacks blocked.
• 185.200.241.249 with 194,979 attacks blocked.
• 62.171.130.153 with 192,778 attacks blocked.
• 185.93.181.158 with 181,508 attacks blocked.
• 188.120.230.132 with 158,873 attacks blocked.
• 104.251.211.115 with 153,350 attacks blocked.