All-in-One SEO and OptinMonster Plugins Updated for Security Patch

WordPress is a popular web content management system and is constantly upgrading. Most people develop their websites using WordPress due to its easy-to-use features that require no coding.

There are different small softwares known as plugins that add to the functioning of WordPress. There are well-known plugins, All in One SEO and OptinMonster, that show vulnerabilities causing risk to the websites.

The WordPress plugins All in One SEO (between versions 4.0.0 and 4.1.5.2) and OptinMonster (versions 2.6.4 and below) contains serious vulnerabilities. These flaws could be exploited by those with restricted access, such as subscribers or registered users, to obtain privileged data from the affected website database, such as usernames and passwords.

The Vulnerabilities in the Optin Monster Plugin 

The flaw is not the result of hackers discovering a way to exploit a flawlessly written WordPress plugin, but it is quite the opposite.

According to security researchers at well-known WordPress security firm Wordfence, the exploit was caused by a breakdown in the WordPress REST-API implementation in the OptinMonster WordPress plugin, which led to “insufficient capability checking”.

By enabling plugins and themes to communicate with a WordPress site to manage and publish content, REST-API provides a secure way to expand WordPress functionality when correctly developed. It enables a plugin or theme to communicate directly with the website database without risking security when the coding is proper.

Recommended Course of Action

After Wordfence’s notification about OptinMonster’s publishers, around ten days later, there was an update with fixed security flaws in the version of the plugin. Wordfence advises all OptinMonster users to update their plugin, as the latest Version 2.6.5 of OptinMonster is the most secure version.

Wordfence words: We advise WordPress users to quickly confirm that their website has been upgraded to the most recent patched version, which at the time of this publication is version 2.6.5.

WordPress claims that REST-API is a secure technology and provides documentation on best practices.

Read More- OpenAI Launches GPTbot: Revolutionizing Conversations through AI

Vulnerabilities of All-in-One SEO Plugin 

Two vulnerabilities occurred in the AIOSEO plugin, and both of them were types of stored cross-site scripting vulnerabilities. It occurs when the malicious script is present on the susceptible site itself.

Any section where a user can upload or submit information, such as a contact form or an image upload form, is vulnerable to hacking. When there are not enough security measures to prevent unwanted inputs, a vulnerability occurs.

So, the exposures in the AIOSEO plugin are:

• The first one was CVE-2023-0585, which arises from the incapable security that can prevent hackers from uploading a malicious script. The threat level rating was 4.4 out of 10, a medium-level vulnerability. Therefore, on the administrator level, one can attack the file.
• The second was CVE-2023-0586, quite similar to the first one but has a higher threat level of 6.4, where an attacker will need the contributor level to access the attacker. A contributor has the ability to create content but cannot publish it.

However, both vulnerabilities are prone to let the attacker create malicious web scripts that can execute with a user action.

Recommended Course of Action

The first vulnerability has a relatively low medium threat level score of 4.4 and administrator-level credentials, while the second vulnerability is rated higher at 6.4.

Therefore, updating all plugins that are sensitive is a good idea. According to the official AIOSEO changelog, the security fix is available in AIOSEO plugin version 4.3.0 and is referred to as extra “security hardening.”

Conclusion

The above-mentioned WordPress plugins have over 3 million users. Having loopholes in such software can lead to a high loss. For that, the Wordfence Threat Intelligence Team issued a Firewall rule for website protection on January 25, 2023.

If you are also using such plugins, it is important to update them with the latest versions, as they have fixed security loopholes and are safe for your websites.

If you are looking for local seo services then visit to Digital Hub Solution.

Read More-Attract Customers to Your Website and Grow Your Business