Description
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | google-maps-easy-pro | 1.6.9 – < 1.7.0 | 1.7.0 |
| — | supsystic-gallery-pro | 2.10.9 – < 2.11.1 | 2.11.1 |
| — | tables-generator-pro | 1.9.20 – < 1.10.1 | 1.10.1 |
References
- https://wpscan.com/vulnerability/7ca5ad30-1792-4014-bfad-88911cd64713/ exploit vdb-entry technical-description