This morning (10.04.19) a security vulnerability was discovered in the (very common) plugin Yuzo Related Posts that allows adding a "Related Posts" widget to your site.
The security weakness allows hackers or malicious software to embed a security hole in your site's database and thereby change the site address (links within the site) and perform redirects to spam sites.
The plugin was blocked from download in the official WordPress plugin directory, and according to The plugin creator's recommendation There is remove the plugin immediately of all your sites.
In addition to uninstalling the plugin you must delete one of the records in the database to ensure complete removal of the security vulnerability.
In your database, go to the table wp_options and delete the record yuzo_related_post_options.
There is another option – deleting all the records created by the Yuzo plugin using a database query:
DELETE FROM `wp_options` WHERE `option_value` like '%yuzo%' If you would like to go deeper into security, don't forget to go over the The Complete Guide to WordPress Site Security, written 4 days ago in direct connection to the OpIsrael attack attempts.
I hope the post was useful to you; if you have additional questions / comments / tips about this security vulnerability – we would be happy to receive comments and shares.
