Cybercriminals start cashing in on vulnerable WordPress websites

The abuse of a vulnerability in the WordPress REST API has taken an expected turn — with the monetization of compromised websites for cyberattackers. The security flaw is a patched vulnerability in the content management system (CMS)’s REST API which permits attackers to modify the content of posts or pages, including editing or outright deletion, and can even allow them to execute malicious code.
Despite the bug being fixed earlier this year, thousands of webmasters are ignoring pleas to update, granting criminals a vast array of websites to exploit.
Two weeks after the patch update was issued by the WordPress security team, researchers found exploits being shared online to take advantage of slack security, leading to a minimum of 66,000 WordPress domains compromised to carry SEO spam (Search Engine Poisoning) and make cyberattackers money through spam-related content.
A number of websites were also the targets of remote code execution attempts.
It is estimated that up to 1.5 million websites may remain unpatched. However, the situation appears to have worsened.
According to researchers from SiteLock, the latest trend in vulnerable WordPress website defacement is the launch of rogue
Source: https://managewp.org/articles/14474/cybercriminals-start-cashing-in-on-vulnerable-wordpress-websites

source https://williechiu40.wordpress.com/2017/02/28/cybercriminals-start-cashing-in-on-vulnerable-wordpress-websites/