Security researchers have shared details about a large-scale attack campaign targeting a set of critical vulnerabilities in The Plus addons for the popular Elementor Pro WordPress website builder.
Web hosting company Seravo first reported the zero-day vulnerabilities in the third-party WordPress plugins, which were already being exploited. Using the exploit, malicious users are able to log in as administrator or create new administrative accounts on any affected site.
The privilege escalation vulnerabilities in the addons are being tracked by Wordfence, which develops a WordPress security plugin of the same name. While analyzing the plugin, the Wordfence security researchers found additional vulnerabilities and notified the developer.
We’re looking at how our readers use VPN for a forthcoming in-depth report. We’d love to hear your thoughts in the survey below. It won’t take more than 60 seconds of your time.
Although the vulnerabilities have already been patched, according to Wordfence there has been no let-up in the attacks.
Unusual campaign
Over the past ten days, Wordfence claims to have blocked over 14 million attacks that hunt for websites using unpatched versions of the vulnerable addons.
This is surprising because the addons are used on only about 30,000 websites, of which nearly 60% are thought to have upgraded to the patched version.
“This campaign is notable in that it is targeting a recent vulnerability and, therefore, has a higher chance of success than the other campaigns we’ve seen recently,” said Wordfence.
“It is also unusual in that it is a set of sustained attacks, whereas attack spikes we’ve seen in the past have typically only lasted a few days before subsiding.”
To shield against attack, affected WordPress users are advised to install the relevant patches immediately.
