{"id":10425,"date":"2025-07-28T12:31:26","date_gmt":"2025-07-28T05:31:26","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10425"},"modified":"2026-02-05T12:31:33","modified_gmt":"2026-02-05T05:31:33","slug":"200-000-website-co-nguy-co-bi-chiem-quyen-vi-lo-hong-plugin-email","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/07\/28\/200-000-website-co-nguy-co-bi-chiem-quyen-vi-lo-hong-plugin-email\/","title":{"rendered":"200.000 website c\u00f3 nguy c\u01a1 b\u1ecb chi\u1ebfm quy\u1ec1n v\u00ec l\u1ed7 h\u1ed5ng plugin email"},"content":{"rendered":"

L\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong plugin Post SMTP khi\u1ebfn h\u01a1n 200.000 website WordPress c\u00f3 nguy c\u01a1 b\u1ecb chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n. Plugin n\u00e0y hi\u1ec7n c\u00f3 h\u01a1n 400.000 l\u01b0\u1ee3t c\u00e0i \u0111\u1eb7t, \u0111\u01b0\u1ee3c d\u00f9ng thay th\u1ebf h\u00e0m g\u1eedi th\u01b0 m\u1eb7c \u0111\u1ecbnh wp_mail() nh\u1eb1m \u0111\u1ea3m b\u1ea3o kh\u1ea3 n\u0103ng g\u1eedi th\u01b0 \u1ed5n \u0111\u1ecbnh v\u00e0 \u0111a d\u1ea1ng h\u01a1n v\u1ec1 t\u00ednh n\u0103ng.<\/b><\/p>\n

\n
\"WordPress.png\"<\/div>\n<\/div>\n

L\u1ed7 h\u1ed5ng nguy hi\u1ec3m n\u00e0y \u0111\u01b0\u1ee3c g\u00e1n m\u00e3 \u0111\u1ecbnh danh CVE-2025-24000 v\u1edbi \u0111i\u1ec3m CVSS l\u00e0 8,8. V\u1ea5n \u0111\u1ec1 b\u1eaft ngu\u1ed3n t\u1eeb m\u1ed9t sai s\u00f3t trong c\u01a1 ch\u1ebf ki\u1ec3m so\u00e1t truy c\u1eadp t\u1ea1i c\u00e1c \u0111i\u1ec3m cu\u1ed1i REST API c\u1ee7a plugin. \u0110\u00e2y l\u00e0 ph\u1ea7n \u0111\u1ea3m nhi\u1ec7m vi\u1ec7c giao ti\u1ebfp gi\u1eefa plugin v\u00e0 h\u1ec7 th\u1ed1ng WordPress. C\u1ee5 th\u1ec3, thay v\u00ec ki\u1ec3m tra k\u1ef9 quy\u1ec1n h\u1ea1n c\u1ee7a ng\u01b0\u1eddi d\u00f9ng tr\u01b0\u1edbc khi cho ph\u00e9p truy c\u1eadp c\u00e1c ch\u1ee9c n\u0103ng nh\u1ea1y c\u1ea3m, h\u1ec7 th\u1ed1ng l\u1ea1i ch\u1ec9 x\u00e1c nh\u1eadn r\u1eb1ng ng\u01b0\u1eddi \u0111\u00f3 \u0111\u00e3 \u0111\u0103ng nh\u1eadp. \u0110i\u1ec1u n\u00e0y c\u00f3 ngh\u0129a l\u00e0 ngay c\u1ea3 nh\u1eefng t\u00e0i kho\u1ea3n c\u00f3 quy\u1ec1n r\u1ea5t th\u1ea5p nh\u01b0 Subscriber, v\u1ed1n ch\u1ec9 \u0111\u01b0\u1ee3c ph\u00e9p \u0111\u1ecdc b\u00e0i vi\u1ebft ho\u1eb7c ch\u1ec9nh s\u1eeda h\u1ed3 s\u01a1 c\u00e1 nh\u00e2n, c\u0169ng c\u00f3 th\u1ec3 truy c\u1eadp v\u00e0o ph\u1ea7n nh\u1eadt k\u00fd email c\u1ee7a h\u1ec7 th\u1ed1ng.<\/p>\n

Nguy hi\u1ec3m \u1edf ch\u1ed7 c\u00e1c nh\u1eadt k\u00fd n\u00e0y kh\u00f4ng ch\u1ec9 l\u01b0u l\u1ea1i th\u00f4ng tin c\u01a1 b\u1ea3n nh\u01b0 ti\u00eau \u0111\u1ec1 hay th\u1eddi \u0111i\u1ec3m g\u1eedi m\u00e0 c\u00f2n ch\u1ee9a to\u00e0n b\u1ed9 n\u1ed9i dung email \u0111\u00e3 g\u1eedi \u0111i. Tin t\u1eb7c c\u00f3 th\u1ec3 l\u1ee3i d\u1ee5ng l\u1ed7 h\u1ed5ng n\u00e0y \u0111\u1ec3 \u00e2m th\u1ea7m theo d\u00f5i c\u00e1c th\u01b0 \u0111i\u1ec7n t\u1eed n\u1ed9i b\u1ed9, trong \u0111\u00f3 c\u00f3 c\u1ea3 email h\u01b0\u1edbng d\u1eabn \u0111\u1eb7t l\u1ea1i m\u1eadt kh\u1ea9u. Ch\u1ec9 c\u1ea7n c\u00f3 m\u1ed9t t\u00e0i kho\u1ea3n c\u1ea5p th\u1ea5p v\u00e0 m\u1ed9t v\u00e0i thao t\u00e1c \u0111\u01a1n gi\u1ea3n, k\u1ebb t\u1ea5n c\u00f4ng ho\u00e0n to\u00e0n c\u00f3 th\u1ec3 y\u00eau c\u1ea7u h\u1ec7 th\u1ed1ng g\u1eedi l\u1ea1i m\u1eadt kh\u1ea9u cho t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb r\u1ed3i \u0111\u1ecdc th\u01b0 \u0111\u1eb7t l\u1ea1i trong ph\u1ea7n nh\u1eadt k\u00fd. T\u1eeb \u0111\u00f3, ch\u00fang d\u1ec5 d\u00e0ng gi\u00e0nh quy\u1ec1n ki\u1ec3m so\u00e1t website m\u00e0 kh\u00f4ng c\u1ea7n v\u01b0\u1ee3t qua th\u00eam l\u1edbp b\u1ea3o v\u1ec7 n\u00e0o. \u0110\u00e2y l\u00e0 h\u00e0nh vi tuy \u0111\u01a1n gi\u1ea3n nh\u01b0ng hi\u1ec7u qu\u1ea3 v\u00e0 ho\u00e0n to\u00e0n h\u1ee3p l\u1ec7 trong m\u1eaft h\u1ec7 th\u1ed1ng.<\/p>\n

\n
\"1753674546461.png\"<\/div>\n<\/div>\n

Ngay sau khi nh\u1eadn \u0111\u01b0\u1ee3c c\u1ea3nh b\u00e1o t\u1eeb c\u1ed9ng \u0111\u1ed3ng b\u1ea3o m\u1eadt, nh\u00e0 ph\u00e1t tri\u1ec3n plugin l\u00e0 Saad Iqbal \u0111\u00e3 nhanh ch\u00f3ng ph\u1ed1i h\u1ee3p c\u00f9ng h\u00e3ng b\u1ea3o m\u1eadt PatchStack \u0111\u1ec3 x\u1eed l\u00fd v\u1ea5n \u0111\u1ec1. B\u1ea3n v\u00e1 \u0111\u01b0\u1ee3c ph\u00e1t h\u00e0nh trong phi\u00ean b\u1ea3n Post SMTP 3.3.0 v\u00e0o ng\u00e0y 11\/6. B\u1ea3n c\u1eadp nh\u1eadt n\u00e0y b\u1ed5 sung c\u01a1 ch\u1ebf ki\u1ec3m tra quy\u1ec1n ng\u01b0\u1eddi d\u00f9ng trong h\u00e0m get_logs_permission, t\u1eeb \u0111\u00f3 ng\u0103n ch\u1eb7n c\u00e1c t\u00e0i kho\u1ea3n tr\u00e1i ph\u00e9p truy c\u1eadp v\u00e0o ph\u1ea7n d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m nh\u01b0 nh\u1eadt k\u00fd email.<\/p>\n

Tuy nhi\u00ean, t\u00ecnh h\u00ecnh th\u1ef1c t\u1ebf cho th\u1ea5y m\u1ed1i nguy v\u1eabn c\u00f2n r\u1ea5t l\u1edbn. Th\u1ed1ng k\u00ea t\u1eeb WordPress.org cho th\u1ea5y ch\u1ec9 kho\u1ea3ng 48,5% ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 c\u1eadp nh\u1eadt l\u00ean phi\u00ean b\u1ea3n an to\u00e0n. H\u01a1n 200.000 website v\u1eabn d\u00f9ng phi\u00ean b\u1ea3n d\u1ec5 b\u1ecb t\u1ea5n c\u00f4ng, t\u1ea1o \u0111i\u1ec1u ki\u1ec7n cho tin t\u1eb7c khai th\u00e1c t\u1eeb t\u00e0i kho\u1ea3n c\u1ea5p th\u1ea5p. \u0110\u00e1ng ch\u00fa \u00fd, kho\u1ea3ng 96.800 website trong s\u1ed1 \u0111\u00f3 v\u1eabn \u0111ang ch\u1ea1y c\u00e1c phi\u00ean b\u1ea3n thu\u1ed9c nh\u00e1nh 2.x. \u0110\u00e2y l\u00e0 c\u00e1c b\u1ea3n r\u1ea5t c\u0169, kh\u00f4ng ch\u1ec9 d\u00ednh l\u1ed7 h\u1ed5ng CVE-2025-24000 m\u00e0 c\u00f2n t\u1ed3n t\u1ea1i nhi\u1ec1u v\u1ea5n \u0111\u1ec1 b\u1ea3o m\u1eadt kh\u00e1c ch\u01b0a t\u1eebng \u0111\u01b0\u1ee3c kh\u1eafc ph\u1ee5c.<\/p>\n

Th\u1ef1c tr\u1ea1ng n\u00e0y cho th\u1ea5y m\u1ed9t nguy c\u01a1 l\u1edbn \u0111ang l\u1eb7ng l\u1ebd r\u00ecnh r\u1eadp trong c\u1ed9ng \u0111\u1ed3ng ng\u01b0\u1eddi d\u00f9ng WordPress. Nhi\u1ec1u website v\u1eabn ch\u01b0a \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt d\u00f9 b\u1ea3n v\u00e1 \u0111\u00e3 c\u00f3 s\u1eb5n. \u0110i\u1ec1u n\u00e0y v\u00f4 t\u00ecnh t\u1ea1o ra m\u1ed9t \u201cc\u00e1nh c\u1eeda m\u1edf\u201d cho nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng, \u0111\u1eb7c bi\u1ec7t l\u00e0 c\u00e1c chi\u1ebfn d\u1ecbch chi\u1ebfm quy\u1ec1n qu\u1ea3n tr\u1ecb t\u1eeb c\u00e1c t\u00e0i kho\u1ea3n c\u1ea5p th\u1ea5p. Trong b\u1ed1i c\u1ea3nh c\u00e1c v\u1ee5 t\u1ea5n c\u00f4ng m\u1ea1ng ng\u00e0y c\u00e0ng ph\u1ed5 bi\u1ebfn v\u00e0 tinh vi, vi\u1ec7c tr\u00ec ho\u00e3n c\u1eadp nh\u1eadt ph\u1ea7n m\u1ec1m d\u00f9 ch\u1ec9 m\u1ed9t th\u1eddi gian ng\u1eafn c\u0169ng c\u00f3 th\u1ec3 ph\u1ea3i tr\u1ea3 gi\u00e1 b\u1eb1ng uy t\u00edn, d\u1eef li\u1ec7u v\u00e0 to\u00e0n b\u1ed9 ho\u1ea1t \u0111\u1ed9ng c\u1ee7a m\u1ed9t trang web.<\/p>\n

Theo Bleeping Computer<\/i><\/b>\u200b<\/div>\n
Theo: https:\/\/whitehat.vn\/threads\/200-000-website-co-nguy-co-bi-chiem-quyen-vi-lo-hong-plugin-email.18606\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"

L\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong plugin Post SMTP khi\u1ebfn h\u01a1n 200.000 website WordPress c\u00f3 nguy c\u01a1 b\u1ecb chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n. Plugin n\u00e0y hi\u1ec7n c\u00f3 h\u01a1n 400.000 l\u01b0\u1ee3t c\u00e0i \u0111\u1eb7t, \u0111\u01b0\u1ee3c d\u00f9ng thay th\u1ebf h\u00e0m g\u1eedi th\u01b0 m\u1eb7c \u0111\u1ecbnh wp_mail() nh\u1eb1m \u0111\u1ea3m b\u1ea3o kh\u1ea3 n\u0103ng g\u1eedi th\u01b0 \u1ed5n \u0111\u1ecbnh v\u00e0 \u0111a d\u1ea1ng h\u01a1n v\u1ec1 t\u00ednh […]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-10425","post","type-post","status-publish","format-standard","hentry","category-tin-tuc-cua-vien"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10425","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=10425"}],"version-history":[{"count":0,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10425\/revisions"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=10425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=10425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=10425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}