A static code analysis of 12 commonly used WordPress e-commerce plug-ins found that at least four of them contained one or more high-risk vulnerabilities.
One of the four offending plug-ins was found with three flaws, while the other three possessed just one, according to application security testing company Checkmarx, which conducted the analysis during the first half of November.
Altogether, the problems consisted of three reflected cross-site scripting flaws, a SQL injection and a second order SQL injection vulnerability, and a file manipulation vulnerability. “Of the vulnerabilities that we have detected so far, if they were exploited, the users of over 135,000 websites could find their personal data threatened by malicious parties or cybercriminals,” Checkmarx stated in a research report posted on Tuesday.
Checkmarx was unable to comment on whether or not there are currently any patched versions of the impacted plug-ins. Additional details on the vulnerabilities will be revealed only after the affected plug-in distributors have had an opportunity to respond to the disclosure, the company noted.
