InfoSecBulletin Cybersecurity for mankind
A hacker changed the code of five plugins on WordPress.org to add harmful PHP scripts that make new admin accounts on websites using the plugins.
The Wordfence Threat Intelligence team found the attack yesterday, but the injections happened between June 21 and June 22, last week. Wordfence found a breach and informed the plugin developers. Patches for most products were released yesterday.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
The five plugins have been installed on over 35,000 websites combined:
Wrapper Link Element 1.0.2 to 1.0.3 (fixed in version 1.0.5)
Social Warfare 4.4.6.4 to 4.4.7.1 (fixed in version 4.4.7.3)
Blaze Widget 2.2.5 to 2.5.2 (fixed in version 2.5.4)
Contact Form 7 Multi-Step Addon 1.0.4 to 1.0.5 (fixed in version 1.0.7)
Simply Show Hooks 1.2.1 to 1.2.2 (no fix available yet)
Wordfence notes that the method used by the threat actor to gain access to the source code of the plugins is currently unknown, but an investigation is ongoing.
The researchers are investigating how the malware became available for download in the WordPress plugin channel. Representatives of WordPress, BLAZE, and Social Warfare didn’t respond to emailed questions. Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.
Wordfence researchers identified the attack through a post made by a member of the WordPress plugins review team on Saturday. They analyzed the malicious file and discovered four other plugins with the same infected code.The researchers wrote further:
“At this stage, we know that the injected malware attempts to create a new administrative user account and then sends those details back to the attacker-controlled server. In addition, it appears the threat actor also injected malicious JavaScript into the footer of websites that appears to add SEO spam throughout the website. The injected malicious code is not very sophisticated or heavily obfuscated and contains comments throughout making it easy to follow. The earliest injection appears to date back to June 21st, 2024, and the threat actor was still actively making updates to plugins as recently as 5 hours ago. At this point we do not know exactly how the threat actor was able to infect these plugins.”
People who installed these plugins should uninstall them right away and check their website for new admin accounts and unauthorized content. Sites using the Wordfence Vulnerability Scanner will get a warning if they have these plugins.
