News

Hackers used flaw in Yuzo Related Posts plugin for a massive attack on WordPress-powered websites

Mail service Mailgun was attacked together with more than a thousand of other companies’ sites on Wednesday, April 10.

During the attack hackers exploited vulnerability in Yuzo Related Posts plugin that allows establishment of scripting between web-sites (XSS). With its help attackers implemented on vulnerable websites a code that redirects users on malware resources, including fake technical service portals, malicious software that was masked under updates, and ads.

“Our applications including the Mailgun Dashboard, APIs, and customer data stored on our platform were not impacted by this issue”, – the company Mailgun said in its status report page.

However, Mailgun was not the only victim of massive attack on websites with vulnerable plugin. Situation could be avoided is researcher that found it informed developer prior to RoS-exploit publishing.

Due to RoS-exploit publishing plugin same day had to be removed from official WordPress plugin library until patch release. Nevertheless, bulk of websites that use Yuzo Related Posts are still vulnerable. According to WordPress, at the moment of plugin removal it was established on 60 thousands websites.

On 10th of April, attacks came as an avalanche, and Yuzo Related Posts developer in dispatch asked website owners to remove problematic plugin. Defiant specialists say that for the attack is responsible one of the groups that actively exploit vulnerabilities in Easy WP SMTP and Social Warfare plugins.

Source: https://www.zdnet.com/article/mailgun-hacked-part-of-massive-attack-on-wordpress-sites/

Polina Lisovskaya

I works as a marketing manager for years now and loves searching for interesting topics for you

Recent Posts

Remove Pbmsoultions.com Pop-up Ads

About Pbmsoultions.com Pbmsoultions.com pop-ups can not launch out of the blue. If you have actually…

13 hours ago

Remove Prizestash.com Pop-up Ads

About Prizestash.com Prizestash.com pop-ups can not expose out of the blue. If you have actually…

13 hours ago

Remove Verifiedbreaking.com Pop-up Ads

About Verifiedbreaking.com Verifiedbreaking.com pop-ups can not launch out of nowhere. If you have actually clicked…

13 hours ago

Remove Themoneyminutes.com Pop-up Ads

About Themoneyminutes.com Themoneyminutes.com pop-ups can not launch out of the blue. If you have actually…

13 hours ago

Remove News-xcidizi.com Pop-up Ads

About News-xcidizi.com News-xcidizi.com pop-ups can not introduce out of nowhere. If you have clicked some…

17 hours ago

Remove Everytraffic-flow.com Pop-up Ads

About Everytraffic-flow.com Everytraffic-flow.com pop-ups can not launch out of nowhere. If you have actually clicked…

17 hours ago