The “Real-Time Find and Replace” WordPress Plugin Updated To Address A High Severity Vulnerability
So as to address a high severity vulnerability, the “Real-Time Find and Replace” WordPress plugin was updated as of late in order to forestall the exploitation to infuse code into sites.
The plugin, accessible as open source and has over 100,000 installations is intended to permit WordPress site admins to dynamically supplant HTML content from themes and different plugins with the content on their personal preference before the page is served to users.
The vulnerability recognized by the name of ‘Cross-Site Request Forgery (CSRF)’ prompting Cross-Site Scripting (XSS), could have permitted an attacker to infuse malignant JavaScript code on a target site, yet just by fooling the administrator into performing explicit actions, such as clicking a link.
The core of the plugin’s ‘functionality’ for including the find and replace rules in the function far_options_page, which didn’t confirm the integrity of a request’s source, since it didn’t utilize nonce verification, WordPress Security Company Defiant had discovered.
By supplanting an HTML tag like <head> with noxious JavaScript, an attacker would ensure that their code executes on about each page of the targeted site. Utilizing the infused code, the attacker could make another administrative account; steal session cookies, or direct clients to a malevolent site.
