This is a vulnerability that has been recently reported too. The vulnerability is actually comprised of a chain of several vulnerabilities that ultimately allow an unauthenticated attacker to execute PHP code on the web server.
The attacker can bypass all security mechanisms and gains control of the store and its complete database, allowing credit card theft or any other administrative access into the system. This attack is not limited to any particular plugin or theme. All the vulnerabilities are present in the Magento core, and affects any default installation of both Community and Enterprise Editions.
Steps you need to take:
If you are using the mentioned vulnerable versions of Magento, we would request you to patch it using the updates provided in the following link : http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/.
You can test whether your Magento website is vulnerability or not, using this tool.
We strongly recommend you access all your packages and patch them immediately to avoid any issues. In case you require any information regarding this email, please feel free to get in touch with us.
Team Crux Softwares
Thursday, May 7, 2015