Script exploited in WordPress theme, bypasses security, sends spam

Script exploited in WordPress theme, bypasses security, sends spam

Hackers, flying beneath the radar, have been using script that's part of a WordPress theme to send spam.

During what was called a routine cleanup investigation, researchers at Sucuri found that hackers were exploiting a PHP script in a premium WordPress theme to send spam.

“While many themes include email functionality, this particular one was troublesome because the script was written without any security checks or direct access prevention,” Sucuri Remediation Team Lead Rodrigo Escobar wrote in a blog. “Without the proper security functions in place, this script can easily be exploited to abuse features and send mass email spam.”

The script, which uses data from POST parameters to send email and is designed to work within the theme, can stand alone as well, “bypassing all security checks in other theme files,” Escobar said. He added that the issue had been exploited by attackers “for quite a while” and were able “to send as many emails as they would like, only limited by the server's configurations.”

This article originally appeared at scmagazineuk.com

Source: Copyright © SC Magazine, UK edition

See more about:  wordpress
 
 

Latest Comments

From our Partners

PC & Tech Authority Downloads