Zero-day vulnerability in ‘Total Donations’ plugin could allow attackers to take over WordPress sites

The zero-day affects all versions of Total Donations plugin, a commercial plugin that is used to gather and manage donations.
The plugin’s code contains several design flaws that inherently expose the plugin and the WordPress site as a whole to external manipulation.

WordPress site owners are being alerted about an unpatched vulnerability discovered in ‘Total Donations’ plugin. The vulnerability, identified as CVE-2019-6703, could allow attackers to take over affected sites.

Security expert Mikey Veenstra from Defiant observed that attackers have been using this zero-day vulnerability to infect several WordPress sites over the past week.

About CVE-2019-6703

The zero-day affects all versions of Total Donations plugin, a commercial plugin that is used to gather and manage donations from the respective user bases.

Giving more details, Veenstra explained that the plugin’s code contains several design flaws that inherently expose the plugin and the WordPress site as a whole to external manipulation.

“Searching the site’s codebase for the strings migla_getme and miglaA_update_me revealed the installed Total Donations plugin, and we quickly identified the exploited vulnerabilities as well as the attacker’s workflow,” said Veenstra in a blog post.

Where does the flaw exist?

The plugin in question contains an AJAX endpoint that can be queried by any unauthorized person.

“Total Donations registers a total of 88 unique AJAX actions into WordPress, each of which can be accessed by unauthenticated users by querying the typical /wp-admin/admin-ajax.php endpoint. We have determined that 49 of these 88 actions can be exploited by a malicious actor to access sensitive data, make unauthorized changes to a site’s content and configuration, or take over a vulnerable site entirely,” Veenstra added.

The AJAX endpoint allows an attacker to change the core setting value of any WordPress site. It can also enable the hacker to modify the destination account of donations received through the plugin and even retrieve Mailchimp mailing lists.

Defiant said that the developer’s site for the plugin appears to have gone inactive since May 2018. As there is no security patch for the vulnerability, users are therefore requested to delete or deactivate the plugin as soon as possible in order to secure their sites.

Before you talk to Our Expert Hardware Firewall Consultant for Hardware Firewall Prices, Please keep below information handy-

It kind of impossible to share the price of all brands in one page as there are Many brands & every brand has 100+ type of hardware firewalls solutions to offer the client.

As a Basic Cost Price Range Starts from 50,000 INR & goes in Lacs of Rupees as per the Need (Users, Location, work, Load , Bandwidth etc.) We Suggest you to Drop an Email to us or Call our Expert Hardware Firewall Consultant Just Now at +91 958 290 7788 to get the best price.

Hardware Firewall Prices are dynamic & keep fluctuating as per the global market up/down. So it is recommended to get latest price for that day.

Please Contact us for all type of Firewalls , You can read more about them at given source.

We provide support for setup of Virtual Private Network ( VPN ), Branch Office VPN and VPN Management Services.

Hardware Firewall Prices

Security solutions at IT Monteur is aimed to protect your business from hackers attack and other Internet threats. We aim at running your business smooth without any worry about securing your data. IT Monteur a Firewall Company in Delhi India, provides firewall software and hardware firewall to protect your data from any mallacious attacks and unexpected crises.

Firewall Software and Hardware Firewall solutions are both designed to block unauthorized access to computers in your network. A firewall software program is installed on each individual PC it’s meant to protect. To safeguard all your company’s computers, however, each one must have a software firewall installed. This can become expensive and difficult to maintain and support. But, a hardware-based firewall is easier to maintain and administer than individual software firewalls. It protect all the computers on your network.

Our firewall security solutions is Combined network and physical security for a more comprehensive approach that meets your needs and that allows you to add integrated protection from hackers, spam, malicious websites, identity theft.

we provide secure access to enable workers at home, at remote sites, or traveling to connect to your business safely and securely Secure storage that gives you the flexible capacity to protect and back up data, video, and images and also provide Physical protection to guard your business and your employees from theft, vandalism, and unlawful access.

Our firewall security solutions Key features:

Standard firewall capabilities: Packet filtering, network address translation (NAT), stateful protocol inspection, Virtual Private Networking
Integrated Network Intrusion Prevention (IPS)
Application Awareness and Control
Additional Intelligence: Directory integration to tie security policies to users and groups; cloud-based reputation services to stop traffic from dangerous sources
Real-time and historical visibility into user, network, and security activity

We are also providing UTM ( Unified threat management ) Firewall Solutions for SMB & Enterprices

Firewalls, both hardware and software, protect computers from hackers and other online threats by blocking dangerous pieces of data from reaching the system. While hardware firewalls offer network-wide protection from external threats, software firewalls installed on individual computers can more closely inspect data, and can block specific programs from even sending data to the Internet. On networks with high security concerns, combining both kinds of firewalls provides a more complete safety net.

We are providing UTM ( Unified threat management ) Best Firewall Solutions for SMB & Enterprises Companies in India

Cisco Firewall, Watch Guard Firewall, Fortigate Firewall, Firewall companies in India, Firewall company India, firewall installation company in delhi, firewall solutions, hardware based firewall provider, network firewall India