"WordPress Plugin Vulnerability Exposed Ferrari Website to Hackers"

Security researchers at Char49 have discovered that a vulnerability in the official website of luxury sports car maker Ferrari could have exposed potentially sensitive information.  The issue was discovered in March.  Ferrari addressed the weakness within a week.  The researchers noticed that the "media.ferrari[.]com" domain is powered by WordPress, and it was running a very old version of W3 Total Cache, a plugin installed on more than a million websites.  The plugin was affected by CVE-2019-6715, a flaw that can be exploited by an unauthenticated attacker to read arbitrary files.  Exploitation of the vulnerability allowed the researchers to obtain the "wp-config.php" file, which stores WordPress database credentials in clear text.  The researchers stated that the exposed database stored information associated with the media[.]ferrari.com domain.  While the researchers did not dig too deep in order to avoid breaking responsible disclosure rules, the vulnerability could have been exploited to access other files on the web server, including ones that could contain information that is of value for threat actors.  After being notified, Ferrari patched the vulnerability by updating the WordPress plugin.  The researchers stated that while in this case there is no indication that the security hole directly exposed customer or other sensitive information, it's important for high-profile companies such as Ferrari to ensure that none of their systems are vulnerable.  In March, Ferrari admitted to being targeted in a ransomware attack in which hackers stole customer information.

SecurityWeek reports: "WordPress Plugin Vulnerability Exposed Ferrari Website to Hackers"