Skip to content

Plugins with vulnerabilities that allow sql injection in WordPress

Published July 14, 2017

This time, I would like to introduce plug-ins that are used a lot with vulnerabilities that allow sql injection. Users of these plug-ins are strongly encouraged to update.


2000px-SQL_ANATOMY_wiki.svg

What is sql injection?

To put it simply, sql injection is a method that can rewrite the contents of a WordPress database (which contains all settings and submission data) in a way that the program originally did not intend. If a malicious user uses sql injection valunability, most changes can be made, including rewriting WordPress posts, taking administrative privileges, and other settings.

There are a lot of plugins and themes that are vulnerable to this sql injection, and they are often corrected by version upgrades. If you use this plugin, we recommend that you update to the latest version.

Sql injection of WordPress it self

Under WordPress 4.3, it is reported that the core file has a SQL Injection vulnerability. This is a sanitization related bug that has been fixed in 4.3

Plug-in sql injection valunability

WP Statistics & lt; Less than 12.0.8 Installed 300,000

NextGEN Gallery & lt; Less than 2.1.57 Installed 1 million

Ninja Forms & lt; Less than 2.9.55.2 Installed 600,000

All In One WordPress Security and Firewall & lt; Less than 3.8 Installed 400,000

Facebook & lt; Less than 1.01 Installed 100,000

SEO Plugin by Yoast WordPress Doctor Malware Scan & Security Plug-in

Related posts:

  1. About the suspension case of the plug-in Display Widgets with malware and how to deal with it
    Display Widgets is a well-known plug-in used by more than 200,000 sites, but this time it was deleted because it contained malware from the officialContinue readingAbout the suspension case of...
  2. Examples of WordPress redirect hacks and how to deal with them
    Increasing cases of falsification are redirected to fake Windows virus removal pages and PC repair pages only when the site is accessed via Google. ThisContinue readingExamples of WordPress redirect hacks...
  3. What to do when the search results indicate “This site may be hacked by a third party”
    If you are running a WordPress site and the number of accesses suddenly drops or, “This site may be hacked by a third party” isContinue readingWhat to do when the...
  4. Distinguish of WordPress sites that are hacked
    I would like to explain the distinguish that were most common among clients who were compromised by hackers. If security measures are taken based onContinue readingDistinguish of WordPress sites that...
  5. WordPress Security Improvement “Plugin Vulnerability”
    One of the most commonly used methods for hacking WordPress is to use plug-in vulnerabilities. In this article, we will explain the most serious vulnerability,Continue readingWordPress Security Improvement “Plugin Vulnerability”...

Published in WordPress Security & Malware removal