Zero-day vulnerability in ‘Total Donations’ plugin could allow attackers to take over WordPress sites

The zero-day affects all versions of Total Donations plugin, a commercial plugin that is used to gather and manage donations.
The plugin’s code contains several design flaws that inherently expose the plugin and the WordPress site as a whole to external manipulation.

WordPress site owners are being alerted about an unpatched vulnerability discovered in ‘Total Donations’ plugin. The vulnerability, identified as CVE-2019-6703, could allow attackers to take over affected sites.

Security expert Mikey Veenstra from Defiant observed that attackers have been using this zero-day vulnerability to infect several WordPress sites over the past week.

About CVE-2019-6703

The zero-day affects all versions of Total Donations plugin, a commercial plugin that is used to gather and manage donations from the respective user bases.

Giving more details, Veenstra explained that the plugin’s code contains several design flaws that inherently expose the plugin and the WordPress site as a whole to external manipulation.

“Searching the site’s codebase for the strings migla_getme and miglaA_update_me revealed the installed Total Donations plugin, and we quickly identified the exploited vulnerabilities as well as the attacker’s workflow,” said Veenstra in a blog post.

Where does the flaw exist?

The plugin in question contains an AJAX endpoint that can be queried by any unauthorized person.

“Total Donations registers a total of 88 unique AJAX actions into WordPress, each of which can be accessed by unauthenticated users by querying the typical /wp-admin/admin-ajax.php endpoint. We have determined that 49 of these 88 actions can be exploited by a malicious actor to access sensitive data, make unauthorized changes to a site’s content and configuration, or take over a vulnerable site entirely,” Veenstra added.

The AJAX endpoint allows an attacker to change the core setting value of any WordPress site. It can also enable the hacker to modify the destination account of donations received through the plugin and even retrieve Mailchimp mailing lists.

Defiant said that the developer’s site for the plugin appears to have gone inactive since May 2018. As there is no security patch for the vulnerability, users are therefore requested to delete or deactivate the plugin as soon as possible in order to secure their sites.

Hardware Firewall Price

Security solutions at IT Monteur is aimed to protect your business from hackers attack and other Internet threats. We aim at running your business smooth without any worry about securing your data. IT Monteur a Firewall Company in Delhi India, provides firewall software and hardware firewall to protect your data from any malicious attacks and unexpected crises.

Firewall Software and Hardware Firewall solutions are both designed to block unauthorized access to computers in your network. A firewall software program is installed on each individual PC it’s meant to protect. To safeguard all your company’s computers, however, each one must have a software firewall installed. This can become expensive and difficult to maintain and support. But, a hardware-based firewall is easier to maintain and administer than individual software firewalls. It protect all the computers on your network.

Our firewall security solutions is Combined network and physical security for a more comprehensive approach that meets your needs and that allows you to add integrated protection from hackers, spam, malicious websites, identity theft.

we provide secure access to enable workers at home, at remote sites, or traveling to connect to your business safely and securely Secure storage that gives you the flexible capacity to protect and back up data, video, and images and also provide Physical protection to guard your business and your employees from theft, vandalism, and unlawful access.

Fortinet – FortiGate Firewalls Price

Fortinet – FortiGate Firewall	Price
FortiGate-30E Hardware plus 1 year 8×5 Forticare and FortiGuard UTM Bundle 1 to 15 users	Rs.53,395/-
FortiGate-60E Hardware plus 1 year 8×5 Forticare and FortiGuard UTM Bundle 1 to 40 users	Rs. 72,331/-
FortiGate-80E Hardware plus 1 year 8×5 Forticare and FortiGuard UTM Bundle 1 to 40 users	Rs. 88,902/-
FortiGate-90E Hardware plus 1 year 8×5 Forticare and FortiGuard UTM Bundle 15 to 60 users	Rs. 1,20,438/-
FortiGate-100E Hardware plus 1 year 8×5 Forticare and FortiGuard UTM Bundle 15 to 100 users	Rs. 1,74,757/-

Sophos Firewall Price

Sophos Firewall	Price
Sophos XG 85 with Full Guard 1 year license ( For 20 User )	Rs. 28,078
Sophos XG 105 with Full Guard 1 year license ( For 30 User )	Rs. 42,237.65
Sophos XG 115 with Full Guard 1 year license ( For 50 User )	Rs. 68,914.30
Sophos XG 125 with Full Guard 1 year license ( For 70 User )	Rs. 98,508.00
Sophos XG 135 with Full Guard 1 year license ( For 100 User )	Rs. 159,432.00

WatchGuard Firewall Price

Watch Guard Firewall	Price
WatchGuard Firewall Firebox T15 with 1-Year Total Security Suite ( For 10 User )	Rs. 43,520/-
WatchGuard Firewall Firebox T35 with 1-Year Total Security Suite ( For 30 User )	Rs. 86,020/-
WatchGuard Firewall Firebox T70 with 1-Year Total Security Suite ( For 50 User )	Rs. 1,36,000/-
WatchGuard Firewall Firebox M270 with 1-Year Total Security Suite ( For 100 User )	Rs. 2,81,220/-
WatchGuard Firewall Firebox M370 with 1-Year Total Security Suite ( For 150 User )	Rs. 3,58,060/-

Our firewall security solutions Key features:

Standard firewall capabilities: Packet filtering, network address translation (NAT), stateful protocol inspection, Virtual Private Networking
Integrated Network Intrusion Prevention (IPS)
Application Awareness and Control
Additional Intelligence: Directory integration to tie security policies to users and groups; cloud-based reputation services to stop traffic from dangerous sources
Real-time and historical visibility into user, network, and security activity

We are also providing UTM ( Unified threat management ) Firewall Solutions for SMB & Enterprices

Firewalls, both hardware and software, protect computers from hackers and other online threats by blocking dangerous pieces of data from reaching the system. While hardware firewalls offer network-wide protection from external threats, software firewalls installed on individual computers can more closely inspect data, and can block specific programs from even sending data to the Internet. On networks with high security concerns, combining both kinds of firewalls provides a more complete safety net.

We are providing UTM ( Unified threat management ) Best Firewall Solutions for SMB & Enterprises Companies in India

Please Contact us for all type of Cyberoam Firewall , Quick Heal Terminator , Sonicwall , NetGenie , Juniper , Gajshield , Checkpoint , Websense , Bluecoat , Barracuda , Cisco Firewall, Watch Guard Firewall, Fortigate Firewallsecurity solutions & Price. We provide support for setup of Virtual Private Network ( VPN ), Branch Office VPN and VPN Management Services.