image credit: unsplash
Despite two critical flaws in a popular WordPress plugin being patched weeks ago, hundreds of thousands of webmasters are yet to deploy the update, putting their sites at risk of takeover attacks.
The “All in One” SEO WordPress plugin was vulnerable to two flaws – CVE-2021-25036, which is a critical Authenticated Privilege Escalation flaw, and CVE-2021-25037, a high-severity Authenticated SQL Injection bug.
In total, three million sites were vulnerable to the flaw. In the past two weeks, since the patch was issued by the plugin’s developers, more than two million plugins were updated, leaving some 820,000 still vulnerable.
Comments are closed.
