Security News > 2021 > January > WordPress Pop-Up Builder Plugin Flaw Plagues 200K Sites

Developers of a plugin, used by WordPress websites for building pop-up ads for newsletter subscriptions, have issued a patch for a serious flaw.

The plugin has been installed on 200,000 WordPress websites.

The issue stems from a lack of authorization for AJAX methods in the plugin.

AJAX is a set of web-development techniques that are used to create web applications; the AJAX method is used to perform an AJAX request.

Without authorization, attackers could utilize this method to import a list of subscribers from a remote URL, which is then handled in the method saveImportedSubscribers.

Earlier in January, researchers warned of two vulnerabilities in a WordPress plugin called Orbit Fox that could allow attackers to inject malicious code into vulnerable websites and/or take control of a website.

News URL

https://threatpost.com/wordpress-pop-up-builder-plugin-flaw-plagues-200k-sites/163500/