WordPress plugin vulnerability opened up one million sites to remote takeover

John Leyden

28 October 2021 at 15:14 UTC

Updated: 28 October 2021 at 15:15 UTC

Gaping OptinMonster security hole patched

Vulnerabilities in OptinMonster, an email marketing plugin for WordPress, left more than a million websites open to exploitation, security researchers at Wordfence warn.

Left unaddressed, the flaws make it possible for an unauthenticated attacker to export sensitive information and add malicious JavaScript to vulnerable WordPress sites, among other exploits.

The Wordfence…