The famous WordPress Plugin, Fancy Product Designer affected by a zero-day
Threat Level – Amber | Vulnerability Report
Download PDFFor a detailed advisory, download the pdf file here.
Hackers are actively exploiting a zero-day vulnerability on the famous Fancy Product Designer, a WordPress plugin, since May 16, 2021. This plugin has been installed on over 17,000 sites. Hive Pro Threat Research Team advises all the users to uninstall this plugin until an official patch is released.
Vulnerability Details
| CVE ID | Affected Versions | Vulnerability Name |
| CVE-2021-24370 | 4.6.8 | Unauthenticated Arbitrary File Upload and Remote Code Execution in WordPress plugin Fancy Product Designer |
Indicators of Compromise
| TYPE | VALUE |
| Hash(MD5) | 4fa00001c720b30102987d980e62d5e4 1d4609806ff0f4e89a3fb5fa35678fa0 |
| IP ADdresses | 69.12.71.82 92.53.124.123 46.53.253.152 |
| Subfolder | wp-admin wp-content/plugins/fancy-product-designer/inc |
References
https://thehackernews.com/2021/06/hackers-actively-exploiting-0-day-in.html
https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/
What’s new on HivePro
Get through updates and upcoming events, and more directly in your inbox