The Wordfence Threat Intelligence security team revealed
last week that several critical vulnerabilities exist in the
Facebook plugin for WordPress.
This plugin has been installed on more than 500.000 Sites
websites, used to capture user actions when they visit a
page and in this way monitor site traffic.
This critical vulnerability received a CVSS severity of
9, with the score given on 22 of December last year, being this day
when researchers privately disclosed this vulnerability to the vendor.
This vulnerability occurred in the PHP object injection found in the
run_action function(), being able to use a custom script that allows
providing that plugin with malicious PHP objects, even reaching to
upload files to a vulnerable website and thus be able to achieve
remote code execution vulnerability.
According to the security team that finds this
vulnerabilidad, attackers could exploit the flaw to access
secret keys of a website without the need for authentication, thus achieving
remote code execution.
The following vulnerability found in the plugin was
discovered on 27 January. In this security flaw, the request is forged
cross-site, leading this to an XSS problem, being an error that was introduced
completely accidentally when changing the name of the plugin in question.
Facebook's security team released a patch for
seguridad para la primera vulnerabilidad el 6 January, aunque fue necesario
lanzar una segunda corrección el 12 de febrero. Hasta el día 17 de febrero no
fue lanzado el parche de seguridad que arreglaba el segundo error, esto fue
debido a que requería ajustes.
Estas dos vulnerabilidades han sido actualizadas en la versión
3.0.4, motivo por el cual se recomienda la actualización de este complemento.