InfoSecBulletin Cybersecurity for mankind
A hacker changed the code of five plugins on WordPress.org to add harmful PHP scripts that make new admin accounts on websites using the plugins.
The Wordfence Threat Intelligence team found the attack yesterday, but the injections happened between June 21 and June 22, last week. Wordfence found a breach and informed the plugin developers. Patches for most products were released yesterday.
Apple Warns of 3 Zero Day Vulns Actively Exploited
The five plugins have been installed on over 35,000 websites combined:
Wrapper Link Element 1.0.2 to 1.0.3 (fixed in version 1.0.5)
Social Warfare 4.4.6.4 to 4.4.7.1 (fixed in version 4.4.7.3)
Blaze Widget 2.2.5 to 2.5.2 (fixed in version 2.5.4)
Contact Form 7 Multi-Step Addon 1.0.4 to 1.0.5 (fixed in version 1.0.7)
Simply Show Hooks 1.2.1 to 1.2.2 (no fix available yet)
Wordfence notes that the method used by the threat actor to gain access to the source code of the plugins is currently unknown, but an investigation is ongoing.
The researchers are investigating how the malware became available for download in the WordPress plugin channel. Representatives of WordPress, BLAZE, and Social Warfare didn’t respond to emailed questions. Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.
Wordfence researchers identified the attack through a post made by a member of the WordPress plugins review team on Saturday. They analyzed the malicious file and discovered four other plugins with the same infected code.The researchers wrote further:
“At this stage, we know that the injected malware attempts to create a new administrative user account and then sends those details back to the attacker-controlled server. In addition, it appears the threat actor also injected malicious JavaScript into the footer of websites that appears to add SEO spam throughout the website. The injected malicious code is not very sophisticated or heavily obfuscated and contains comments throughout making it easy to follow. The earliest injection appears to date back to June 21st, 2024, and the threat actor was still actively making updates to plugins as recently as 5 hours ago. At this point we do not know exactly how the threat actor was able to infect these plugins.”
People who installed these plugins should uninstall them right away and check their website for new admin accounts and unauthorized content. Sites using the Wordfence Vulnerability Scanner will get a warning if they have these plugins.
