Tracking WordPress Plugin Vulnerabilities Causing Malicious Redirects
SiteLock research and remediation teams have become aware of several WordPress plugin vulnerabilities that are affecting our customers. The symptoms most commonly associated with these WordPress plugin vulnerabilities are malicious redirects. Essentially, visitors are being sent to another website than the one they are attempting to access. We are still gathering information on these vulnerabilities, and how they are being used. As soon as we have completed our review, we will release more information.
The affected WordPress plugins are:
At this time, the Live Chat with Facebook Messenger plugin has been updated, but the Smart Google Code Inserter has not been updated in a year, and the WP Live Chat Support is currently not available from the WordPress plugin archives. If you are using any of the affected plugins, be sure to update immediately to the patched version, or disable them until a patch is released.
Using a web application firewall (WAF) to filter malicious and suspicious traffic can help protect your site against vulnerabilities. Automatic vulnerability scanners and bots used by attackers can lead to compromises. Using a WAF helps stop that threat before it reaches your site.