WordPress: Five Plugins Found with Malicious Code

Pietro Melillo : 25 June 2024 14:03

On June 24, 2024, Wordfence revealed a supply chain attack on WordPress plugins, leading to the compromise of five plugins with malicious code. The affected plugins are:

1. Social Warfare (versions 4.4.6.4 to 4.4.7.1)
2. Blaze Widget (versions 2.2.5 to 2.5.2)
3. Wrapper Link Element (versions 1.0.2 to 1.0.3)
4. Contact Form 7 Multi-Step Addon (versions 1.0.4 to 1.0.5)
5. Simply Show Hooks (version 1.2.1)

The malicious code aimed to create a new admin user and inject SEO spam into site footers. The compromised versions are no longer listed in the WordPress repository.

Attack Details

The attack was detected by Wordfence while analyzing the Social Warfare plugin, following a forum post by the WordPress Plugin Review team. Further investigation revealed that four more plugins were similarly compromised. The malware attempted to create an unauthorized admin account and send credentials to an attacker-controlled server, in addition to adding SEO spam via malicious JavaScript.

Response and Recommendations

Supporta RHC acquistando il Corso CTI:

Supporta RHC attraverso:

• L'acquisto del fumetto sul Cybersecurity Awareness
• Seguendo RHC su WhatsApp
• Seguendo RHC su Telegram
• Scarica gratuitamente "Dark Mirror", il report sul ransomware di Dark Lab

Wordfence advised users to:

• Check for Indicators of Compromise: Including unauthorized admin accounts and connections to IP address 94.156.79.8.
• Remove Compromised Plugins: Until a safe version is confirmed, users should remove the affected plugins.
• Perform a Full Security Audit: Using tools like Wordfence’s Vulnerability Scanner or CLI.

For detailed steps on securing compromised sites, Wordfence has provided a guide on their website.

Conclusion

This attack highlights the importance of constant vigilance and prompt response to security alerts. Users are encouraged to stay updated on plugin security and adopt best practices for managing WordPress sites to mitigate such risks.

For more details, visit the original Wordfence blog post.

Pietro Melillo
Head of the Dark Lab group. A Computer Engineer specialised in Cyber Security with a deep passion for Hacking and technology, currently CISO of WURTH Italia, he was responsible for Cyber Threat Intelligence & Dark Web analysis services at IBM, carries out research and teaching activities on Cyber Threat Intelligence topics at the University of Sannio, as a Ph.D, author of scientific papers and development of tools to support cybersecurity activities. Leads the CTI Team "RHC DarkLab"