Description

Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T17:17:28.507Z",
  "pubdate": "2026-09-03T17:17:28.507Z",
  "executiveSummary": "MalCare Security versions 6.69 and earlier contain a critical vulnerability allowing for Unauthenticated Denial of Service (DoS) attacks. This flaw enables remote, unauthenticated actors to disrupt service availability by leveraging improper input validation or resource management within the plugin's request handling logic.\nThe vulnerability resides in the way the plugin processes incoming requests, potentially allowing an attacker to trigger resource exhaustion or application instability without requiring administrative privileges or local access. The impact is significant, as successful exploitation can lead to a complete service outage, preventing legitimate administrators and users from accessing the WordPress dashboard or the protected site.\nThe risk is elevated due to the lack of authentication requirements, allowing any network-adjacent or remote entity to initiate the attack. Organizations utilizing MalCare Security versions 6.69 or below are at risk of service disruption. Mitigation requires immediate update to a patched version once available or implementing temporary network-level access controls to restrict exposure to the vulnerable endpoint.",
  "technicalDetails": "The vulnerability is characterized as an Unauthenticated Denial of Service (DoS) condition affecting MalCare Security versions <= 6.69. The root cause pertains to improper handling of request parameters or lack of rate limiting/input sanitization on a publicly exposed endpoint, allowing an attacker to disproportionately consume server resources.\nDuring standard operation, the MalCare plugin intercepts various HTTP requests to perform security scanning, monitoring, or telemetry. In the affected versions, specific endpoints are reachable without session validation. An attacker can craft malicious, non-authenticated HTTP requests directed at the vulnerable file or function responsible for background processing or state transitions. By submitting specifically formatted requests that bypass standard WordPress security layers or internal request validation mechanisms, the attacker forces the server to execute resource-intensive logic or enter an infinite loop/crash state.\nThe attack flow proceeds as follows: First, the attacker identifies the exposed endpoint within the MalCare Security plugin structure that does not verify authentication tokens (such as nonces or session cookies). Second, the attacker sends a series of crafted requests designed to maximize CPU usage, memory allocation, or database query overhead. Third, because the plugin fails to implement sufficient throttle mechanisms or input validation before processing these requests, the server-side process responsible for the MalCare logic consumes excessive system resources.\nThe exploitation does not require administrative privileges or valid credentials. The attack is executable over the network (Internet-facing). The payload behavior involves inducing either an immediate crash of the PHP execution environment or a state of resource exhaustion that stalls the web server, effectively rendering the site unresponsive for legitimate traffic. Post-exploitation, the attacker has successfully achieved a denial of service, forcing a manual intervention or service restart by the administrator to restore availability.\nThis vulnerability is particularly dangerous as it targets the security plugin itself, which is designed to protect the system. By disabling the plugin or crashing the server through this vector, an attacker may also bypass secondary protections or prepare the environment for further unauthorized actions if the system configuration is rendered unstable."
}