The WordPress platform is yet again under attack, thanks to vulnerabilities across old and new versions of the content management system.
If a logged-in administrator visits the affected page, the hacker could acquire access to the server, Klikki Oy warned. “Alternatively the attacker could change the administrator’s password, create new administrator accounts, or do whatever else the currently logged-in administrator can do on the target system.” For website admins, the advice for now is to disable comments until a fix is released.
Ryan Dewhurst, security researcher and owner of the WordPress vulnerability database WPScan, told FORBES he’d tested the attack code and it worked. His own proof of concept hack can be found on Github. He noted the attack requires the hacker to have a previously approved comment on the target site so the comment containing the exploit does not need approving.