Among all content management systems (CMS), WordPress is being used by a third of all websites. A WordPress zero-day vulnerability in any CMS have always been a concern. The most recent one affected a plugin called Easy WP SMTP.
Easy WP SMTP Plugin allows WordPress-based site owners to send script-based emails through an SMTP server instead of a default wordpress sendmail protocol. Using SMTP potentially prevents messages from being rejected by a recipient’s server or flagged as spam to be dismissed as junk mail.
A zero-day vulnerability is a vulnerability in a program, system or device that has been discovered and disclosed before developers became aware of them. The patch has not yet been created. An exploit that attacks a zero-day vulnerability is called a zero-day exploit. It is considered a high-risk vulnerability, since affected systems are exposed to cybercriminals. Launch targeted attacks to hack websites with unpatched plugins usually follow.
Even after the patch has been issued, the vulnerability is still a concern for site owners who are not staying on top of the updates for this popular CMS platform.
In this latest exploit of a critical zero-day vulnerability of the WP SMTP version 1.3.9, hackers reportedly gained administrative access and were able to alter content on WordPress websites. Older versions of the plugin are not vulnerable. Best option for those running a 1.3.9 version, should update to the latest version of the plugin, 1.3.9.1, right away.