No Follow All External Links 2.1.0 - 2.3.0 - Backdoor
Strategic Overview
2.1.0 – 2.3.0N/AVulnerability Overview
The No Follow All External Links plugin for WordPress is vulnerable to a backdoor in versions 2.1.0 - 2.3.0. This is due to the criminal actor purchasing the plugin and adding the backdoor themselves. This makes it possible for authenticated attackers to inject content into the vulnerable plugin, commonly used in the past for SEO Spam.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-912 (Hidden Functionality) The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C