# Bug In WordPress Plugin Can Let Hackers Wipe Up To 200,000 Sites

**URL:** <https://onehack.st/t/bug-in-wordpress-plugin-can-let-hackers-wipe-up-to-200-000-sites/70183>\
**Category:** News & Articles\
**Tags:** tools, programming, hacking\
**Created:** [February 17, 2020, 10:57pm UTC](https://onehack.st/t/bug-in-wordpress-plugin-can-let-hackers-wipe-up-to-200-000-sites/70183 "2020-02-17T22:57:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [February 17, 2020, 10:57pm UTC](https://onehack.st/t/bug-in-wordpress-plugin-can-let-hackers-wipe-up-to-200-000-sites/70183/1 "2020-02-17T22:57:19Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/a/8/a89ea9aceacb3f9f75f4482ec2cb36407d6f4fce.jpeg)

An anonymous reader quotes a report from ZDNet:

> WordPress site owners who use commercial themes provided by ThemeGrill are advised to update one of the plugins that come installed with these themes in order to patch a critical bug that can let attackers wipe their sites. The vulnerability resides in [ThemeGrill Demo Importer](https://wordpress.org/plugins/themegrill-demo-importer/), a plugin that ships with themes sold by [ThemeGrill](https://themegrill.com/), a web development company that sells commercial WordPress themes. The plugin, which [is installed on more than 200,000 sites](https://www.zdnet.com/article/bug-in-wordpress-plugin-can-let-hackers-wipe-up-to-200000-sites/), allows site owners to import demo content inside their ThemeGrill themes so they’ll have examples and a starting point on which they can build their own sites.

 ![image](https://onehack.st/uploads/default/original/3X/c/8/c87287435b24cceadde5a8a673d482993caffbfb.png)

_However, in [a report](https://www.webarxsecurity.com/critical-issue-in-themegrill-demo-importer/) published yesterday, WordPress security firm WebARX says that older versions of the ThemeGrill Demo Importer are vulnerable to remote attacks from unauthenticated attackers. Remote hackers can send a specially crafted payload to vulnerable sites and trigger a function inside the plugin._

The vulnerable function resets the site’s content to zero, effectively wiping the content of all WordPress sites where a ThemeGrill theme is active, and the vulnerable plugin is installed.

- Furthermore, if the site’s database contains a user named “admin,” then the attacker is granted access to that user with full administrator rights over the site.