actively-exploited-vulnerabilityinternet-facing-service-vulnerabilitywidely-deployed-product-advisoryfinancial-sector-threat

Active Exploitation of Fancy Product Designer Zero-Day Enables WordPress RCE

Active Exploitation · 2 sources · Updated 3mo ago · First seen Jan 30, 2021

Attackers actively exploited a critical zero-day in the Fancy Product Designer plugin for WordPress, including deployments tied to WooCommerce, by scanning for vulnerable sites and abusing a malicious file upload flaw to achieve remote code execution. The vulnerability allowed unauthenticated attackers to upload executable PHP files, giving them a path to fully compromise affected websites.

Researchers at Wordfence said the activity appeared focused on e-commerce sites, where intruders could steal order data containing customer personally identifiable information and expose merchants to potential PCI-DSS compliance issues. Wordfence observed exploitation beginning on January 30, 2021, and urged site owners to update to Fancy Product Designer version 4.6.9, which was released to address the issue.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jan 30, 2021

Reported Jun 1, 20215y ago
Patched Fancy Product Designer version 4.6.9 is released
A patched release, Fancy Product Designer version 4.6.9, was issued to fix the vulnerability. Users were urged to update immediately because the plugin lacked an automatic update mechanism and some configurations could remain exploitable even after deactivation.
Critical WordPress plugin zero-day under active exploitation
Reported Jun 1, 20215y ago
Wordfence publicly discloses zero-day with limited details
Wordfence publicly disclosed the Fancy Product Designer zero-day while it was still under active attack and before a patch was available. The company withheld some technical details but shared indicators of compromise, including attacker IP addresses, to help defenders detect intrusions.
Critical WordPress plugin zero-day under active exploitation
Jan 30, 20216y ago
Attackers begin exploiting Fancy Product Designer zero-day
Wordfence observed active exploitation of a critical remote code execution vulnerability in the WordPress Fancy Product Designer plugin beginning on January 30, 2021. Attackers were scanning for vulnerable sites and abusing malicious file uploads to gain full control, with e-commerce stores appearing to be the primary targets.
Critical WordPress plugin zero-day under active exploitation

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Affected products

2 linked

WordpressWoocommerce

Organizations

1 linked

Woocommerce

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Bleeping ComputerNews · Jun 1, 2021

Critical WordPress plugin zero-day under active exploitationOpen source ↗

WordfenceNews

[no-title]Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilityinternet-facing-service-vulnerabilitywidely-deployed-product-advisoryfinancial-sector-threat

Active Exploitation of Fancy Product Designer Zero-Day Enables WordPress RCE

Active Exploitation · 2 sources · Updated 3mo ago · First seen Jan 30, 2021

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jan 30, 2021

Reported Jun 1, 20215y ago
Patched Fancy Product Designer version 4.6.9 is released
A patched release, Fancy Product Designer version 4.6.9, was issued to fix the vulnerability. Users were urged to update immediately because the plugin lacked an automatic update mechanism and some configurations could remain exploitable even after deactivation.
Critical WordPress plugin zero-day under active exploitation
Reported Jun 1, 20215y ago
Wordfence publicly discloses zero-day with limited details
Wordfence publicly disclosed the Fancy Product Designer zero-day while it was still under active attack and before a patch was available. The company withheld some technical details but shared indicators of compromise, including attacker IP addresses, to help defenders detect intrusions.
Critical WordPress plugin zero-day under active exploitation
Jan 30, 20216y ago
Attackers begin exploiting Fancy Product Designer zero-day
Wordfence observed active exploitation of a critical remote code execution vulnerability in the WordPress Fancy Product Designer plugin beginning on January 30, 2021. Attackers were scanning for vulnerable sites and abusing malicious file uploads to gain full control, with e-commerce stores appearing to be the primary targets.
Critical WordPress plugin zero-day under active exploitation

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Affected products

2 linked

WordpressWoocommerce

Organizations

1 linked

Woocommerce

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Bleeping ComputerNews · Jun 1, 2021

Critical WordPress plugin zero-day under active exploitationOpen source ↗

WordfenceNews

[no-title]Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Active Exploitation of Fancy Product Designer Zero-Day Enables WordPress RCE

How this story unfolded

Patched Fancy Product Designer version 4.6.9 is released

Wordfence publicly discloses zero-day with limited details

Attackers begin exploiting Fancy Product Designer zero-day

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical WooCommerce Wholesale Lead Capture Flaw Exploited to Hijack WordPress Sites

Active Exploitation of Everest Forms Pro RCE Creates Rogue WordPress Admins

Critical WordPress Plugin Flaws Expose Sites to File Upload, SQL Injection, and Takeover

Active Exploitation of Fancy Product Designer Zero-Day Enables WordPress RCE

How this story unfolded

Patched Fancy Product Designer version 4.6.9 is released

Wordfence publicly discloses zero-day with limited details

Attackers begin exploiting Fancy Product Designer zero-day

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical WooCommerce Wholesale Lead Capture Flaw Exploited to Hijack WordPress Sites

Active Exploitation of Everest Forms Pro RCE Creates Rogue WordPress Admins

Critical WordPress Plugin Flaws Expose Sites to File Upload, SQL Injection, and Takeover