Thousands of WordPress websites affected by MailPoet vulnerability.

A recent vulnerability was identified within the popular MailPoet WordPress Plugin. The security group Sucuri.net identified the exploit that allows an attacker to remotely upload any file to the vulnerable website with no authentication in place to prevent it. This is threatening vulnerability by a very popular WordPress plugin (over 1,700,000 downloads). See article.

This is a major threat because an attacker would be able to upload any kind of executable file which he or she could use for any purposes. It has been reported that servers were sending SPAM, hosting malware, phishing for passwords, and also infecting other hosting customers on shared servers.

The security group's team discovered this vulnerability when performing services and disclosed it to the MailPoet team who then responded by immediately releasing a patch for the popular software. The security group recommends that developers do not use the admin_init() or is_admin() functions as an authentication method. More details can be found on the WordPress Codex website.

While simple counter measures could be used to prevent this from happening with any software, most webmasters just don't protect themselves. For instance, something as simple as setting the most basic file permissions across your website directories could prevent vulnerabilities like these from being a threat. If you run this plugin on your website it is very important that you upgrade immediately. At the time of this writing 2.6.7 is the only known version to be safe for use.

This is another reminder of why it is important to always make sure your websites are buttoned down and to be mindful of the plugins that you download and install for your websites. Please be reminded that all Pledged Plugins products follow the best practices for various web applications and we always develop our software with a security first mindset.