Ally Plugin Flaw Exposes 200,000 WordPress Sites

A critical security vulnerability in the Ally WordPress plugin has exposed more than 200,000 websites to potential data theft, cybersecurity experts warn, even as a patch has been available for weeks.

The flaw, identified as CVE-2024-2413 and rated with a severity score of 7.5 out of 10, affects the Ally plugin, an accessibility tool developed by Elementor and used on over 400,000 active WordPress sites worldwide. Discovered in early February 2024 by security researcher Drew Webber at Acquia, the issue allows unauthenticated attackers to exploit an SQL injection vulnerability through a specially crafted URL. This enables the extraction of sensitive database information, such as administrator credentials, email addresses, and password hashes, without requiring login access.

The vulnerability stems from the plugin's handling of user-supplied URL parameters in its get_global_remediations function. Researchers at Wordfence, who coordinated the responsible disclosure through their bug bounty program, explained that the parameter is directly inserted into an SQL JOIN clause without adequate sanitization for the database context. While the plugin applies WordPress's esc_url_raw...