Vulnerabilities and security researches forblaze-widget blaze-widget

Jun 26, 2024

CVE, Research URL: 5aa63b7aac05249d22e77bf0bcbe643aaba6f01b
Home page URL: Security reports for BLAZE Retail Widget
Application: BLAZE Retail Widget
Date: Jun 24, 2024
Research Description: BLAZE Retail Widget [blaze-widget] >= 2.2.5 - <= 2.5.2 (closed) Several WordPress.org Plugins <= Various Versions - Injected Backdoor Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. All plugins have received updates reverting any added malicious code. Simply Show Hooks affected version (1.2.1) is the same as the patched version (1.2.1) - it does not appear that the malicious copy was ever officially released, so sites running 1.2.1 should be unaffected, though it is a good idea to run a complete Wordfence scan and verify that there are no rogue administrator accounts present.
Affected versions: Min -, max -.
Status: vulnerable

Jul 22, 2024

CVE, Research URL: CVE-2024-6297
Home page URL: Security reports for BLAZE Retail Widget
Application: BLAZE Retail Widget
Date: Jun 25, 2024
Research Description: Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
Affected versions: Min -, max -.
Status: vulnerable