The popular page-builder plugin WPBakery, installed in over 4 million websites, was discovered to host a critical flaw that allowed for attackers with contributor-level or above permissions, to inject malicious JavaScript in posts.

After a long period of patch development by the plugin team, a working patch was finally released on September 24, 2020.

We highly recommend updating to the latest version immediately (version 6.4.1 or higher). Simultaneously, we also recommend double-checking your website user list to make sure that no untrusted contributor-level or higher accounts have made their way inside.

For more information, please check the official public release.

If you have questions, don’t hesitate to contact our support team.

People that read this article also liked

Critical Vulnerabilities Found on PageLayer Page Builder Plugin Critical Security Flaw in outdated WooCommerce NAB Transact Plugin WordPress Websites Security Breach – Outbreak of Malicious File Attacks WordPress 5.7 “Esperanza” + WooCommerce 5.1 Released