We are reaching out to you today because there has been an increase in the number of websites infected with SEO Spam, and the attack vector is the WP Mobile Detector plugin. The plugin has a new Zero Day vulnerability allowing attacker to exploit a Arbitrary File Upload (AFU) vulnerability. The plugin has been removed from the WordPress repository and does not have an active patch available.
The zero day was disclosed May 31st, and we were able to track live attacks going back to May 27th. We have actively tested the most popular application level security plugins for WordPress and the exploits are evading their prevention controls.
The plugin has since been removed from the WordPress repository and no patches are available.
The vulnerability is very easy to exploit. All the attacker needs to do is send a request to resize.php or timthumb.php (yes, timthumb, in this case it just includes resize.php), inside the plugin directory with the backdoor URL.
It’s imperative that if you are using this plugin you remove it from your environment and find a suitable replacement.
Leave a Reply