WordPress Plugins Simple 301 Redirects & NicDark Series: Unauth siteurl Modification Leading to Traffic Redirection

Key Information Summary Vulnerability Description - Multiple WordPress Plugins Exploited: Vulnerabilities in WordPress plugins are being exploited to redirect website traffic. - Affected Plugins: Simple 301 Redirects – Addon – Bulk Uploader, and multiple plugins developed by NicDark (now Endreww), including Components For WP Bakery Page Builder, Donations, Travel Management, Booking, and Learning Courses. Vulnerability Mechanism - Exploitation of AJAX Requests: Attackers exploit actions within the plugins, allowing unauthenticated visitors to successfully send AJAX requests and modify the setting, redirecting visitors to other locations. - CSV File Upload Vulnerability: The Simple 301 Redirects – Addon – Bulk Uploader plugin contains a vulnerability that allows attackers to upload CSV files, leading to widespread redirection of website traffic. Impact - Attack Start Date: Around July 31, 2019, coinciding with the initial public disclosure of one of the vulnerabilities. - Attack Method: Plugins were quickly removed from repositories due to similar vulnerabilities affecting them. - Ongoing Threat: Although the base installation base of these plugins is relatively small, the widespread presence of plugin repositories makes these probing attacks rapid and highly destructive. Additional Information - Wordfence Warning: Researchers warned WordPress users in a Friday article to update promptly to avoid attacks. - Related Plugins: Analysts also identified chained attacks targeting other vulnerable plugins, including Woocommerce User Email Verification, Yellow Pencil Visual Theme Customizer, and Maintenance Mode.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Plugins Simple 301 Redirects & NicDark Series: Unauth siteurl Modification Leading to Traffic Redirection