Kotsi e kotsi (CVE-3-2022) e khethiloe ho UpdraftPlus WordPress add-on, e nang le lisebelisoa tse fetang limilione tse 0633 tse sebetsang, tse lumellang mosebedisi oa motho oa boraro ho khoasolla kopi ea database ea sebaka seo, ho phaella ho dikahare, e na le liparamente tsa basebelisi bohle le li-hashes tsa password. Taba ena e rarolloa ho litokollo tsa 1.22.3 le 2.22.3, tse khothalletsoang hore basebelisi bohle ba UpdraftPlus ba li kenye kapele kamoo ho ka khonehang.
UpdraftPlus e nkoa e le tlatsetso e tsebahalang haholo ea ho theha li-backups tsa libaka tse sebetsang sethaleng sa WordPress. Ka lebaka la tlhahlobo e fosahetseng ea litokelo tsa phihlello, tlatsetso e lumelletse ho jarolla kopi ea "backup" ea sebaka sa marang-rang le database e amanang le eona eseng feela ho batsamaisi, empa le ho mosebelisi e mong le e mong ea ngolisitsoeng setšeng, mohlala, ka boemo ba ba ngolisitseng.
Ho kenya li-backups ho UpdraftPlus, ho sebelisoa sesupo se hlahisoang ho latela nako eo bekapo e entsoeng ka eona le tatellano e sa reroang (nonce). Bothata ke hore ka lebaka la khaello ea licheke tse nepahetseng ho mofani oa kopo ea ho otla ha pelo ea WordPress, a sebelisa kopo e entsoeng ka ho khetheha, mosebelisi leha e le ofe a ka fumana tlhahisoleseding mabapi le bekapo ea morao-rao, e kenyeletsang tlhahisoleseding e mabapi le nako le tatellano e sa tloaelehang e amanang le eona.
E latelang, ho latela tlhaiso-leseling e fumanoeng, o ka hlahisa sesupo mme oa khoasolla kopi ea bekapo o sebelisa mokhoa oa ho jarolla ka lengolo-tsoibila. Mosebetsi oa maybe_download_backup_from_email o sebelisitsoeng ka mokhoa ona o hloka ho fumana leqephe la likhetho-general.php, le fumanehang feela ho mookameli. Leha ho le joalo, mohlaseli a ka tlola thibelo ena ka ho senya $pagenow e feto-fetohang e sebelisitsoeng cheke le ho romela kopo ka leqephe la ts'ebeletso le lumellang ho fihlella ke basebelisi ba se nang tokelo. Ka mohlala, u ka ikopanya le leqephe bakeng sa ho romela molaetsa ho mookameli ka ho romela kopo ka mokhoa "wp-admin/admin-post.php/%0A/wp-admin/options-general.php?page=updraftplus ”.
Source: opennet.ru