WordPress: Five Plugins Found with Malicious Code

Pietro Melillo : 25 June 2024 14:03

On June 24, 2024, Wordfence revealed a supply chain attack on WordPress plugins, leading to the compromise of five plugins with malicious code. The affected plugins are:

1. Social Warfare (versions 4.4.6.4 to 4.4.7.1)
2. Blaze Widget (versions 2.2.5 to 2.5.2)
3. Wrapper Link Element (versions 1.0.2 to 1.0.3)
4. Contact Form 7 Multi-Step Addon (versions 1.0.4 to 1.0.5)
5. Simply Show Hooks (version 1.2.1)

The malicious code aimed to create a new admin user and inject SEO spam into site footers. The compromised versions are no longer listed in the WordPress repository.

Attack Details

The attack was detected by Wordfence while analyzing the Social Warfare plugin, following a forum post by the WordPress Plugin Review team. Further investigation revealed that four more plugins were similarly compromised. The malware attempted to create an unauthorized admin account and send credentials to an attacker-controlled server, in addition to adding SEO spam via malicious JavaScript.

Response and Recommendations

Iscriviti GRATIS alla RHC Conference 2025 (Venerdì 9 maggio 2025)

Il giorno Venerdì 9 maggio 2025 presso il teatro Italia di Roma (a due passi dalla stazione termini e dalla metro B di Piazza Bologna), si terrà la RHC Conference 2025. Si tratta dell’appuntamento annuale gratuito, creato dalla community di RHC, per far accrescere l’interesse verso le tecnologie digitali, l’innovazione digitale e la consapevolezza del rischio informatico.

La giornata inizierà alle 9:30 (con accoglienza dalle 9:00) e sarà interamente dedicata alla RHC Conference, un evento di spicco nel campo della sicurezza informatica. Il programma prevede un panel con ospiti istituzionali che si terrà all’inizio della conferenza. Successivamente, numerosi interventi di esperti nazionali nel campo della sicurezza informatica si susseguiranno sul palco fino alle ore 19:00 circa, quando termineranno le sessioni. Prima del termine della conferenza, ci sarà la premiazione dei vincitori della Capture The Flag prevista per le ore 18:00.
Potete iscrivervi gratuitamente all'evento utilizzando questo link.

Per ulteriori informazioni, scrivi a [email protected] oppure su Whatsapp al 379 163 8765

Supporta RHC attraverso:

• L'acquisto del fumetto sul Cybersecurity Awareness
• Ascoltando i nostri Podcast
• Seguendo RHC su WhatsApp
• Seguendo RHC su Telegram
• Scarica gratuitamente "Dark Mirror", il report sul ransomware di Dark Lab

Ti piacciono gli articoli di Red Hot Cyber? Non aspettare oltre, iscriviti alla newsletter settimanale per non perdere nessun articolo.

Wordfence advised users to:

• Check for Indicators of Compromise: Including unauthorized admin accounts and connections to IP address 94.156.79.8.
• Remove Compromised Plugins: Until a safe version is confirmed, users should remove the affected plugins.
• Perform a Full Security Audit: Using tools like Wordfence’s Vulnerability Scanner or CLI.

For detailed steps on securing compromised sites, Wordfence has provided a guide on their website.

Conclusion

This attack highlights the importance of constant vigilance and prompt response to security alerts. Users are encouraged to stay updated on plugin security and adopt best practices for managing WordPress sites to mitigate such risks.

For more details, visit the original Wordfence blog post.

Pietro Melillo
Head of the Dark Lab group. A Computer Engineer specialised in Cyber Security with a deep passion for Hacking and technology, currently CISO of WURTH Italia, he was responsible for Cyber Threat Intelligence & Dark Web analysis services at IBM, carries out research and teaching activities on Cyber Threat Intelligence topics at the University of Sannio, as a Ph.D, author of scientific papers and development of tools to support cybersecurity activities. Leads the CTI Team "RHC DarkLab"

Lista degli articoli