The Slider Revolution WordPress premium plugin (developed by ThemePunch) has a serious vulnerability that allows attackers to access the servers of all sites. The venerability affects older versions of the plugin (pre version 4.2).
The Slider Revolution premium plugin is very popular and its one of the most downloaded slider plugins featured on Envato’s Marketplace. According to online sources this has been a known problem but the plugin developers chose to silently patch their plugin in the hope of avoiding bad publicity at the expense of making a number of WordPress websites venerable to attack.
The vulnerability (exhibited in older versions of the plugin) allows an attacker to read and download any file in your WordPress website – including the wp-config.php file, which contains your database username and password. With this information an attacker has unrestricted access to your WordPress website, which is particularly worrying for E-Commerce websites storing personal details about their customers.
In February ThemePunch (the developers of the Slider Revolution plugin) mentioned in the release notes of version 4.2 that a security issue had been fixed but didn’t release any details about the problem or its impact.
“As the developer of the Slider Revolution Responsive WordPress Plugin (referred to as “RevSlider” in this article), we would like to clarify a few things to offer some additional transparency on what has happened in the last year.
Direct buyers of our plugin were hardly affected by the exploit, as they could use our automatic update tool to keep their plugin up to date and secure. The nature of plugins bundled in themes however caused a lot of older plugin versions to linger around on the web and providing a window for malicious attacks.”ThemePunch – Sucuri Blog – Revslider leads to massive WordPress Compromise
How Do You Secure Your Website?
Please follow the steps below to re-secure your WordPress website. If you regularly update your WordPress plugins your website may not have been affected but its worth following the steps below to ensure the security of your website is maintained. If you’re non-technical and need support re-securing your website please get in contact and I can assist you.
- Make a backup of your site
- While logged in, visit the item page for the plugin: Slider Revolution
- Download the item by clicking on the Download free update button
- Locate the downloaded zip file on your computer and unzip it
- Connect to your server using an FTP client and go to the /wp-content/plugins/ folder
- Delete the revslider folder from your website so you know any and all insecure plugin files have been deleted
- Upload the revslider folder to the /wp-content/plugins/ folder
- Log into WordPress and go to the Plugins page
- Find the revslider plugin in the list – make sure it says Version 4.2 (or higher)
- Update your WordPress user passwords
- Check the user login list to ensure no additional user accounts have been setup on your site
- Once your website is secure – go and make a nice cup of tea or coffee and take a well deserved break!
Update: 9th March 2015
ThemePunch (The plugin developers) have significantly improved their plugin and resolved the issues that are mentioned above. They have added in the ability for you to automatically update the plugin to ensure any security patches are applied as soon as possible. I’ve used the plugin a number of times and we honestly believe its one of the best out there.
If you’re non-technical and need support re-securing your website please get in contact and me or my team can assist you.
We may link to products and online services provided by third-parties. Soe of the links that we post on our site are affiliate links, which means that we receive commission if you purchase the item. We will never recommend a product or service that we have not used ourselves. Our reviews will be honest and we will only recommend something if we have found it useful.
Disclaimer:Lacey Tech Solutions publish blog articles to help small businesses. We are not liable for any damages if you choose to follow the advice from our blog.