InfoSecBulletin Cybersecurity for mankind
A hacker changed the code of five plugins on WordPress.org to add harmful PHP scripts that make new admin accounts on websites using the plugins.
The Wordfence Threat Intelligence team found the attack yesterday, but the injections happened between June 21 and June 22, last week. Wordfence found a breach and informed the plugin developers. Patches for most products were released yesterday.
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
The five plugins have been installed on over 35,000 websites combined:
Wrapper Link Element 1.0.2 to 1.0.3 (fixed in version 1.0.5)
Social Warfare 4.4.6.4 to 4.4.7.1 (fixed in version 4.4.7.3)
Blaze Widget 2.2.5 to 2.5.2 (fixed in version 2.5.4)
Contact Form 7 Multi-Step Addon 1.0.4 to 1.0.5 (fixed in version 1.0.7)
Simply Show Hooks 1.2.1 to 1.2.2 (no fix available yet)
Wordfence notes that the method used by the threat actor to gain access to the source code of the plugins is currently unknown, but an investigation is ongoing.
The researchers are investigating how the malware became available for download in the WordPress plugin channel. Representatives of WordPress, BLAZE, and Social Warfare didn’t respond to emailed questions. Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.
Wordfence researchers identified the attack through a post made by a member of the WordPress plugins review team on Saturday. They analyzed the malicious file and discovered four other plugins with the same infected code.The researchers wrote further:
“At this stage, we know that the injected malware attempts to create a new administrative user account and then sends those details back to the attacker-controlled server. In addition, it appears the threat actor also injected malicious JavaScript into the footer of websites that appears to add SEO spam throughout the website. The injected malicious code is not very sophisticated or heavily obfuscated and contains comments throughout making it easy to follow. The earliest injection appears to date back to June 21st, 2024, and the threat actor was still actively making updates to plugins as recently as 5 hours ago. At this point we do not know exactly how the threat actor was able to infect these plugins.”
People who installed these plugins should uninstall them right away and check their website for new admin accounts and unauthorized content. Sites using the Wordfence Vulnerability Scanner will get a warning if they have these plugins.
