WordPress security company Wordfence this week detected a large scale coordinated attack against over 1.6 million WordPress websites running exploited plugins and Epsilon Framework themes.
The hack allows for the creation of new WodPress Administrator accounts, allowing full control of your website.
If you are running any of these software versions you should update your site immediately. You should also look at your Users list for any unrecognised Administrator accounts and delete.
Here are the vulnerable plugins and versions:
- PublishPress Capabilities <= 2.3
- Kiwi Social Plugin <= 2.0.10
- Pinterest Automatic <= 4.14.3
- WordPress Automatic <= 3.53.2
And these themes:
- Shapely <=1.2.8
- NewsMag <=2.4.1
- Activello <=1.4.1
- Illdy <=2.1.6
- Allegiant <=1.2.5
- Newspaper X <=1.3.1
- Pixova Lite <=2.0.6
- Brilliance <=1.2.9
- MedZone Lite <=1.2.5
- Regina Lite <=2.0.5
- Transcend <=1.1.9
- Affluent <1.1.0
- Bonkers <=1.0.5
- Antreas <=1.0.6
- NatureMag Lite – No patch known. Recommended to uninstall from site.
More details on the Wordfence Blog
As always, if you need assistance or advice, drop a note to our support team or get in touch.
