Nearly 50,000 WordPress websites continue to be using versions of the Backup Migration plugin impacted by a critical flaw, tracked as CVE-2023-6553, nearly a week after patches have been released, BleepingComputer reports.
Exploiting the vulnerability, which was identified by the Nex Team flaw hunting group, could enable website takeovers through remote code execution even for unauthenticated attackers, a report from Wordfence showed.
"By submitting a specially crafted request, threat actors can leverage this issue to include arbitrary, malicious PHP code and execute arbitrary commands on the underlying server in the security context of the WordPress instance," said Wordfence.
Such a flaw has emerged following a phishing campaign against WordPress admins that involved the installation of fraudulent plugins to address the fake CVE-2023-45124 vulnerability, as well as the release of patches for a Property Oriented Programming chain bug that could allow arbitrary PHP code execution in particular instances.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.