Popular AMP Plugin for WordPress Patches Critical Flaw – Update Now

A security researcher has disclosed details of a critical
vulnerability in one of the popular and widely active plugins for
WordPress that
could allow a low-privileged attacker to inject malicious code on
AMP pages of the targeted website.

The vulnerable WordPress plugin in question is “AMP for WP –
Accelerated Mobile Pages” that lets websites automatically
generate valid accelerated mobile pages for their blog posts and
other web pages.

AMP, stands for
Accelerated Mobile Pages, is an open-source technology that
has been designed by Google to allow websites build and server
faster web pages to mobile visitors.
^[2]

Though I am pretty sure the main version of “The Hacker News”
website is enough fast for both desktop and mobile device users,
you can also check the AMP version for
this specific article here.

Out of hundreds of plugins that allows WordPress websites to
create Google-optimize AMP pages, “AMP for WP” is the most popular
among others with more than 100,000 installations.

The affected plugin was recently removed temporarily from the
WordPress plugins library due to vulnerable code, but neither its
developer nor the WordPress team revealed the exact issue in the
plugin.

Cybersecurity researcher Luka Sikic from web security firm WebARX
analyzed the vulnerable plugin version and spotted a code-injection
vulnerability in the “AMP for WP” that was later patched in its
updated version.

The vulnerability resided in the way the ‘AMP for WP –
Accelerated Mobile Pages’ plugin handled permissions for user
accounts and WordPress AJAX hooks.

Under its settings, the plugin offers website administrators
options to add advertisements and custom HTML/JavaScript code in
the header or footer of an AMP page. To do this, the plugin uses
WordPress’ built-in /AJAX hooks functionality in the
background.
Since every registered user on a WordPress site, even with the
lowest privileges, are authorized to call AJAX hooks and also since
the vulnerable plugin doesn’t check if the account calling the AJAX
hooks is admin or not, any user of the site can make use of this
function to inject custom code.

As demonstrated by the researcher in a video, a low-privileged
user can simply temper any request to call AJAX hooks and can
submit malicious JavaScript code in the site.

This vulnerability has now been addressed in the latest version
0.9.97.20 of AMP for WP – Accelerated Mobile
Pages.
^[5]

If your WordPress website also uses the affected plugin, you
are highly recommended to install the latest available security
updates as soon as possible.

It’s just 15th of this month, and a weakness in another popular
WordPress plugin has been discovered affecting hundreds of
thousands of websites out there.

Just last week, an arbitrary file deletion vulnerability was
disclosed in the popular WooCommerce
plugin^[6] that could have allowed
a malicious or compromised privileged user to gain full control
over the WordPress websites.

^[1][3]