Spikes in Attacks Serve as a Reminder to Update Plugins

Keypoints

• Spikes in exploit attempts targeted Kaswara Modern VC Addons (<= 3.0.1) and Adning Advertising (<= 1.5.5) plugins, with firewall rules already in place for Wordfence users.
• The holiday/ weekend timing suggests attackers exploit when site admins are less attentive.
• During the spikes, 1,969,494 Kaswara sites and 1,075,458 Adning sites were observed hitting these vulnerabilities, far above normal block volumes.
• The Kaswara vulnerability allows unauthenticated arbitrary file uploads, enabling PHP uploads and remote code execution on vulnerable WordPress sites.
• The Adning vulnerability includes unauthenticated file upload and unauthenticated file deletion (potentially deleting wp-config.php), leading to full site compromise.
• At disclosure, Kaswara affected about 8,000 WordPress users; Adning affected about 680 users; both plugins remained unpatched or only partially patched in some cases.
• Recommendation: keep all website components up to date and consider a Web Application Firewall to block exploits; remove Kaswara if still installed and upgrade Adning.