Remote Code Execution to access one’s device through a vulnerability is not a new thing, however still one of the ways for hackers to take advantage and make use of another site’s resources to execute malicious actions nonetheless. Without authentication a hacker can take control of a WordPress site including but not limited to accessing the directory of the site itself.
Further WordPress Issues?
The further problem of getting a directory accessed is not because there might be sensitive personal files such as one’s own embarrassing photos. We have been having problems of privacy across social media all too much already, that people (ordinary consumers mostly) forget that far more dangerous than shame is to get attacked by a phishing attempt, then get redirected to a phishing site.
Our phishing intelligence team noticed that a rise in privacy leaks and issues correlates with the rise in phishing attacks, and the success rate is symmetrical to it. While there are multiple sources from different security sites that phishing attacks are on the rise, it is also safe to say that in midst of the security vulnerabilities of WordPress, comes an increase in the number of injected phishing sites. What comes with the trend of leaked emails and passwords are the combination of social engineered attacks that make use of the leaked credentials to promote the injected phishing site while guising the attack to replicate a corporate crafted emails that will be blasted out to the personal contacts combined with the leaked email addresses that were uncrack able.
WordPress based e-stores
The dangers of getting your e-stores made with WordPress hacked up to the root level could lead to a breach of people’s financial credentials. Why need to phish when criminals can directly access a victim’s FULLz? The answer is, for more phishing victims.
FULLz through a zero day hacking by a zero day hacker can get away with all the details for himself, thus taking advantage all the credentials where it could be sold to the Dark Web, where our Darkweb Monitoring scouts the ever continuous Credit Card and Debit Card merkatplace still lives on, or use all the hacked credentials to social engineer oneself to scam and phish all the clueless personal contacts in the hacked accounts.
Prevention?
It involves an outdated WordPress platform, then the only sure fire way solution is to update your WordPress to the latest version. Other than that, your coders should make every effort to secure your file folders in your directory whatever means possible within the reach of the existing codes.
