There is an enormous Cross Site Request Forgery (CSRF) Attack currently underway against all WordPress Platforms. Wordfence, a WordPress Security Plugin I HIGHLY RECOMMEND (and both the free and premium levels are excellent) is recording approximately 13007 attacks PER MINUTE. They are also reporting,
There is a CSRF and directory traversal vulnerability in the commercial LayerSlider WordPress plugin version 4.6.1. The vulnerability was released publicly on March 11th. We haven’t been able to find the change history with dates for LayerSlider, but the current version appears to be 5.1.1 and we suspect 4.6.1 is a recent version, so please check which version you’re running and upgrade if necessary. The vulnerability may also affect older versions of LayerSlider. This is a popular plugin and is incorporated in many themes. You can find out more about the vulnerability on PacketStorm.
We’re seeing an increase in brute force attacks (password guessing attacks) across WordPress sites from 2000/min to peaks of 15,000 currently. The attack started just after noon yesterday March 18th Pacific Time and gradually increased to a peak of 15,000 attacks per minute today March 19th at 5am and it’s currently holding at that frequency. This looks like it will be a sustained attack and will likely last from 24 more hours to several days. Please keep a close eye on your WordPress sites for unusual activity and ensure your backups are current. Share this data with any other WordPress site owners you know. As always you can view/track the attack using our real-time graph and attack map at http://www.wordfence.com/
A vendor recently posted a blog entry on XMLRPC based distributed denial of service attacks. The post was picked up in the press and we have received several questions about this. The issue the vendor mentions is a well known item that the WordPress core team has been aware of since 2007. It generated a fair amount of press and WordPress creator Matt Mullenweg released the following statement:
“This tradeoff in pingback’s design has been there for a decade now. It’s seldom used outside of experimentation because it gets shut down by anti-spam providers like Akismet or web hosts when used at any scale, and there are cheaper, easier, and more effective ways to DDOS sites. That’s why no serious attacks (above 2gbps) use it.” [source]
It’s important to note that this issue does not introduce a vulnerability in sites that enable pingback via XMLRPC, but merely lets an attacker bundle your site into a huge number of other WordPress sites and use those sites to send a large amount of traffic to a target site in the hope of bringing that site to its knees under the heavy load. As Matt says, there are far easier ways to overwhelm a website with traffic.
Our recommendation is to install Akismet spam filtering for comments, which you’ve probably already done – and keep your themes, plugins and WordPress core versions current, which you’re hopefully already doing. You should also be wary of running any software that is not maintained by an active author or development community and that includes your themes and plugins. If a legitimate vulnerability exists in WordPress core, the core dev team will release a fix in a timely fashion.
If you or your Firm have a need for Website Security; if your .htaccess isn’t up to par or you have no idea what that means, reach out TODAY for a Consultation! Remember, with the latest audits underway, if you have a website which is insecure, your CLIENT WILL PAY THE PRICE and loose Contracts!
