а для Joomla тоже хотим

PSA: Remove Kaswara Modern WPBakery Page Builder Addons Plugin Immediately

This entry was posted in Research, Vulnerabilities, WordPress Security on April 21, 2021 by Chloe Chamberland 5 Replies

Today, April 21, 2021, the Wordfence Threat Intelligence team became aware of a critical 0-day vulnerability that is being actively exploited in Kaswara Modern WPBakery Page Builder Addons, a premium plugin that we estimate has over 10,000 installations. This vulnerability was reported this morning to WPScan by “Robin Goodfellow.” The exploited flaw makes it possible for unauthenticated attackers to upload malicious PHP files to a WordPress site and ultimately achieve remote code execution to take over the site.

In addition to the actively exploited flaw, we discovered several vulnerable endpoints that could allow attackers to do a wide range of things like deleting arbitrary files and injecting malicious javascript. Due to the fact that this plugin has been closed and the plugin developer has been unresponsive, we urge you to remove this plugin completely from your WordPress site immediately. We have identified several vulnerabilities in this plugin which could allow unauthenticated attackers the ability to take over vulnerable WordPress sites, and numerous other vulnerabilities with lesser impacts.

Wordfence Premium customers received firewall rules this morning, on April 21, 2021, to protect against active exploitation of these vulnerabilities. Wordfence users still using the free version will receive the same protection on May 21, 2021.
Description: Arbitrary File Upload/Deletion and Other
Affected Plugin: Kaswara Modern WPBakery Page Builder Addons
Plugin Slug: kaswara
Affected Versions: <= 3.0.1
CVE ID: CVE-2021-24284
CVSS Score: 10.0 (Critical)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Fully Patched Version: NO AVAILABLE PATCH.

At this time, we are releasing minimal details due to this being an actively exploited vulnerability with no available patch. We may decide to release more details in the future, but in the meantime we recommend you take appropriate measures to secure your site.

aurymasis,

это правда. не ставьте его. или ставьте только если хорошо знаете, как защитить сайт.
я по логам на свежем сайте (без плагина) вижу как в него долбятся ящеры всякие в поисках входа.

Плагин через время показал что он с вредоносным кодом, сайт тупо вместо Главной страницы начал перебрасывать на другие ссылки.
Как отключил плагин сразу стало все ок.