Analysis finds high-risk vulnerabilities in four popular WordPress e-commerce plug-ins

News by Bradley Barth

A static code analysis of 12 commonly used WordPress e-commerce plug-ins found that at least four of them contained one or more high-risk vulnerabilities.

A static code analysis of 12 commonly used WordPress e-commerce plug-ins found that at least four of them contained one or more high-risk vulnerabilities.

One of the four offending plug-ins was found with three flaws, while the other three possessed just one, according to application security testing company Checkmarx, which conducted the analysis during the first half of November.

Altogether, the problems consisted of three reflected cross-site scripting flaws, a SQL injection and a second order SQL injection vulnerability, and a file manipulation vulnerability. “Of the vulnerabilities that we have detected so far, if they were exploited, the users of over 135,000 websites could find their personal data threatened by malicious parties or cyber-criminals,” Checkmarx stated in a research report posted on Tuesday.

Checkmarx was unable to comment on whether or not there are currently any patched versions of the impacted plug-ins. Additional details on the vulnerabilities will be revealed only after the affected plug-in distributors have had an opportunity to respond to the disclosure, the company noted.

Topics:

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Upcoming Events