Attackers take advantage of a critical remote execution defect code affecting over 600.000 WordPress sites. Her vulnerability the we mentioned in a previous publication and concerns websites running vulnerable versions of the File plugin Managers.
Critical vulnerability allows unauthorized users to upload malicious PHP files and run malicious code. The File Manager developer team addressed the issue with the release of File Manager 6.9.
Although the flaw was patched immediately when developers were notified by Seravo security manager Ville Korhonen, who discovered 0day and the ongoing attacks trying to exploit it, researchers from security firm Defiant found more than 1,7 millions vulnerable websites from 1st to 3rd September.
In an updated report released today, Defiant threat analyst Ram Gall states that hackers have not stopped their "siege", and the total number of WordPress sites they target has reached 2,6 million.
