InfoSecBulletin Cybersecurity for mankind
A hacker changed the code of five plugins on WordPress.org to add harmful PHP scripts that make new admin accounts on websites using the plugins.
The Wordfence Threat Intelligence team found the attack yesterday, but the injections happened between June 21 and June 22, last week. Wordfence found a breach and informed the plugin developers. Patches for most products were released yesterday.
Intel PC, laptop and server processors affected for 6 years: Report
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
The five plugins have been installed on over 35,000 websites combined:
Wrapper Link Element 1.0.2 to 1.0.3 (fixed in version 1.0.5)
Social Warfare 4.4.6.4 to 4.4.7.1 (fixed in version 4.4.7.3)
Blaze Widget 2.2.5 to 2.5.2 (fixed in version 2.5.4)
Contact Form 7 Multi-Step Addon 1.0.4 to 1.0.5 (fixed in version 1.0.7)
Simply Show Hooks 1.2.1 to 1.2.2 (no fix available yet)
Wordfence notes that the method used by the threat actor to gain access to the source code of the plugins is currently unknown, but an investigation is ongoing.
The researchers are investigating how the malware became available for download in the WordPress plugin channel. Representatives of WordPress, BLAZE, and Social Warfare didn’t respond to emailed questions. Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.
Wordfence researchers identified the attack through a post made by a member of the WordPress plugins review team on Saturday. They analyzed the malicious file and discovered four other plugins with the same infected code.The researchers wrote further:
“At this stage, we know that the injected malware attempts to create a new administrative user account and then sends those details back to the attacker-controlled server. In addition, it appears the threat actor also injected malicious JavaScript into the footer of websites that appears to add SEO spam throughout the website. The injected malicious code is not very sophisticated or heavily obfuscated and contains comments throughout making it easy to follow. The earliest injection appears to date back to June 21st, 2024, and the threat actor was still actively making updates to plugins as recently as 5 hours ago. At this point we do not know exactly how the threat actor was able to infect these plugins.”
People who installed these plugins should uninstall them right away and check their website for new admin accounts and unauthorized content. Sites using the Wordfence Vulnerability Scanner will get a warning if they have these plugins.
