ACF Plugin’s Reflected XSS Vulnerability Attracts Exploit Attempts Within 24 Hours of Public Announcement – WP Tavern

On Might 5, Patchstack printed a safety advisory a few excessive severity reflected cross-site scripting (XSS) vulnerability in ACF (Superior Customized Fields), probably affecting greater than 4.5 million customers. WP Engine patched the vulnerability on Might 4, however the Akamai Safety Intelligence Group (SIG)  is reporting that attackers started making an attempt to take advantage of it inside 24 hours of Patchstack’s publication.

“As soon as exploit vector particulars are publicly launched, scanning and exploitation makes an attempt quickly improve,” Akamai Principal Safety Researcher Ryan Barnett mentioned. “It is not uncommon for safety researchers, hobbyists, and corporations trying to find their danger profile to look at new vulnerabilities upon launch. Nevertheless, the amount is growing, and the period of time between launch and mentioned progress is drastically lowering. The Akamai SIG analyzed XSS assault knowledge and recognized assaults beginning inside 24 hours of the exploit PoC being made public.

“What is especially fascinating about that is the question itself: The menace actor copied and used the Patchstack pattern code from the write-up.“

Patchstack’s safety advisory features a breakdown of the vulnerability, pattern payload, and particulars of the patch.

Though the vulnerability, assigned CVE-2023-30777, was promptly patched, and WP Engine alerted its customers the identical day, web site homeowners have been sluggish to replace to the newest, patched model of the plugin (6.1.6). Solely 31.5% of the plugin’s consumer base are working model 6.1+, leaving a good portion nonetheless susceptible until they’re protected by extra safety measures like digital patches.

“Exploitation of this results in a mirrored XSS assault by which a menace actor can inject malicious scripts, redirects, adverts, and different types of URL manipulation right into a sufferer web site,” Barnett mentioned. “This could, in flip, push these illegitimate scripts to guests of that affected web site. This manipulation is basically blind to the location proprietor, making these threats much more harmful.”

Barnett famous that attackers utilizing the pattern code from Patchstack signifies these usually are not refined makes an attempt, however the complete safety advisory makes susceptible websites straightforward to focus on.

“This highlights that the response time for attackers is quickly lowering, growing the necessity for vigorous and immediate patch administration,” Barnett mentioned.