The popular Van Ons WordPress plugin for GDPR compliance, with more than 100,000 active installations, was patched on November 7th due to a privilege escalation vulnerability ( CVE–2018–19207 ) found in version 1.4.2. The WP GDPR Compliance plugin helps website owners meet the recent GDPR European data privacy regulation. This came into effect in May of this year, boosting the plugin's popularity. Starting on 10th November, our Threat Intelligence Group noticed a surge in attacks targeting this exploit vector.   Imunify360 customers were already protected by a WAF rule issued several days earlier. This rule detects and blocks malicious payloads attempting to exploit this attack vector. ...

Activity Our monitoring systems identified a first-wave malicious campaign on April 12th, 2018, the same day that proof of concept code went public. The Drupal core security team had earlier released security advisory SA-CORE–2018–002 on the 28th March. We released our blocking and detection rules a few days later meaning that Imunify360 customers were already protected by the time the campaign started. October saw a new burst of attacks on this vector. Botnets located on thousands of IPs requested access to Drupal-based sites to upload a malicious payload. The chart below shows the activity levels for the past few months. Recognition Most connections were attempting to extract the server's ...