Application security, Network Security, Vulnerability Management

Script exploited in WordPress theme, bypasses security, sends spam

During what was called a routine cleanup investigation, researchers at Sucuri found that hackers were exploiting a PHP script in a premium WordPress theme to send spam.

“While many themes include email functionality, this particular one was troublesome because the script was written without any security checks or direct access prevention,” Sucuri Remediation Team Lead Rodrigo Escobar wrote in a blog. “Without the proper security functions in place, this script can easily be exploited to abuse features and send mass email spam.”

The script, which uses data from POST parameters to send email and is designed to work within the theme, can stand alone as well, “bypassing all security checks in other theme files,” Escobar said. He added that the issue had been exploited by attackers “for quite a while” and were able “to send as many emails as they would like, only limited by the server's configurations.”

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.