Yesterday Matt Barry, researchers at Wordfence discovered a SQL injection vulnerability in WooCommerce version 2.3.5 and more established amid a code review of the plugin storehouse. WooCommerce is introduced on more than 1 million active WordPress websites.
Wordfence has quickly reached Woo about the issue and they've been unimaginably responsive, discharging a fix early today with their arrival of WooCommerce version 2.3.6.
We emphatically recommend you instantly upgrade on the off chance that you have not as of now.
The particular issue is a SQL injection weakness in the administrator board. Inside the Tax Settings page of WooCommerce, the key of the "tax_rate_country" POST parameter is passed unescaped into a SQL insert articulation. For instance, a payload of tax_rate_country[(SELECT SLEEP(10))] would result in the MySQL server to rest for 10 seconds.
Since this helplessness requires either a Shop Manager or Admin client account, it would need to be consolidated with a XSS attack so as to be misused.
What to do: Upgrade promptly to version 2.3.6 of WooCommerce which contains the fix.
Thanks to the WooThemes team for instantly tending to the issue and pushing the fix inside a couple of HOURS of accepting the report.
If you don't mind make sure to tweet, FB or email as expected to help spread the saying to your kindred WordPress site admins.
No comments:
Post a Comment