Almost a million WordPress websites at risk from this security flaw — here's what you need to know to keep your site safe

Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
(Image credit: Shutterstock/monticello)

Almost a million WordPress websites were vulnerable to a flaw that allowed hackers to modify content on different pages. 

A report from Wordfence noted the vulnerability could lead to hackers altering sensitive data and potentially exploiting the website builder system.

As per the report, the websites were vulnerable through a WordPress plugin called Website Builder, developed by SeedProd which has more than 900,000 active installations. The vulnerability involved a missing capability check in one of the plugin’s functions, allowing hackers to modify content on sites such as “coming soon”, maintenance pages, or 404 pages, created using the plugin. 


Reader offer: Get up to 75% off on hosting with Hostinger

Reader offer: Get up to 75% off on hosting with Hostinger

Get top-notch performance, extensive features, and unbeatable value for money. With Hostinger you can enjoy free domain, SSL, backups, and more. Upgrade for professional extras like NVMe storage, CDN, and WordPress caching.

Preferred partner (What does this mean?) 

Targeting plugins

WordPress websites with versions up to 6.15.21 of the plugin installed were vulnerable, the report further stated. SeedProd has addressed it, however, and released a patch bringing the plugin up to version 6.15.22. All WordPress website owners using the plugin are advised to apply the patch immediately.

The vulnerability itself is tracked as CVE-2024-1072, and carries a severity score of 8.2/10 in the Common Vulnerability Scoring System (CVSS), making it a “high risk” flaw. 

WordPress is by far the world’s most popular website builder, powering almost half (43%) of all websites on the internet. This also makes it an extremely popular target among hackers. However, WordPress is generally considered safe, as less than 1% of all known vulnerabilities on the platform target the website builder itself. 

Instead, hackers usually look for flaws in plugins and addons, as many of them aren’t as thoroughly monitored, or frequently updated, as they should be. This rings particularly true for non-commercial plugins, which are often built by a single developer, and sometimes abandoned, but still widely used. Administrators are advised to always keep all of their plugins updated.

More from TechRadar Pro

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Top WordPress plugins found to have some serious security flaws, so make sure you're protected
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Over a million WordPress sites exposed to attack from W3 Total Cache plugin flaw
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Thousands of WordPress websites hit in new malware attack, here's what we know
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Another serious WordPress plugin vulnerability could put 40,000 sites at risk of attack
WordPress
Another top WordPress plugin found carrying critical security flaws
Wordpress brand logo on computer screen. Man typing on the keyboard.
Thousands of WordPress sites targeted with malicious plugin backdoor attacks
Latest in Security
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
UK Prime Minister Sir Kier Starmer
The UK releases timeline for migration to post-quantum cryptography
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
Latest in News
Ray-Ban Meta Smart Glasses
Samsung's rumored smart specs may be launching before the end of 2025
Apple iPhone 16 Review
The latest iPhone 18 leak hints at a major chipset upgrade for all four models
Quordle on a smartphone held in a hand
Quordle hints and answers for Monday, March 24 (game #1155)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Monday, March 24 (game #386)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Monday, March 24 (game #652)
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 23 (game #1154)