WordPress: Five Plugins Found with Malicious Code

Pietro Melillo : 25 June 2024 14:03

On June 24, 2024, Wordfence revealed a supply chain attack on WordPress plugins, leading to the compromise of five plugins with malicious code. The affected plugins are:

1. Social Warfare (versions 4.4.6.4 to 4.4.7.1)
2. Blaze Widget (versions 2.2.5 to 2.5.2)
3. Wrapper Link Element (versions 1.0.2 to 1.0.3)
4. Contact Form 7 Multi-Step Addon (versions 1.0.4 to 1.0.5)
5. Simply Show Hooks (version 1.2.1)

The malicious code aimed to create a new admin user and inject SEO spam into site footers. The compromised versions are no longer listed in the WordPress repository.

Attack Details

The attack was detected by Wordfence while analyzing the Social Warfare plugin, following a forum post by the WordPress Plugin Review team. Further investigation revealed that four more plugins were similarly compromised. The malware attempted to create an unauthorized admin account and send credentials to an attacker-controlled server, in addition to adding SEO spam via malicious JavaScript.

Response and Recommendations

Vorresti toccare con mano la Cybersecurity e la tecnologia? Iscriviti GRATIS ai WorkShop Hands-On della RHC Conference 2025 (Giovedì 8 maggio 2025)

Se sei un ragazzo delle scuole medie, superiori o frequenti l'università, oppure banalmente un curioso di qualsiasi età, il giorno giovedì 8 maggio 2025 presso il teatro Italia di Roma (a due passi dalla stazione termini e dalla metro B di Piazza Bologna), si terranno i workshop "hands-on", creati per far avvicinare i ragazzi alla sicurezza informatica e alla tecnologia. Questo anno i workshop saranno:

Creare Un Sistema Ai Di Visual Object Tracking (Hands on)

Social Engineering 2.0: Alla Scoperta Delle Minacce DeepFake

Doxing Con Langflow: Stiamo Costruendo La Fine Della Privacy?

Come Hackerare Un Sito WordPress (Hands on)

Il Cyberbullismo Tra Virtuale E Reale

Come Entrare Nel Dark Web In Sicurezza (Hands on)

Potete iscrivervi gratuitamente all'evento, che è stato creato per poter ispirare i ragazzi verso la sicurezza informatica e la tecnologia.
Per ulteriori informazioni, scrivi a [email protected] oppure su Whatsapp al 379 163 8765

Supporta RHC attraverso:

• L'acquisto del fumetto sul Cybersecurity Awareness
• Ascoltando i nostri Podcast
• Seguendo RHC su WhatsApp
• Seguendo RHC su Telegram
• Scarica gratuitamente "Dark Mirror", il report sul ransomware di Dark Lab

Ti piacciono gli articoli di Red Hot Cyber? Non aspettare oltre, iscriviti alla newsletter settimanale per non perdere nessun articolo.

Wordfence advised users to:

• Check for Indicators of Compromise: Including unauthorized admin accounts and connections to IP address 94.156.79.8.
• Remove Compromised Plugins: Until a safe version is confirmed, users should remove the affected plugins.
• Perform a Full Security Audit: Using tools like Wordfence’s Vulnerability Scanner or CLI.

For detailed steps on securing compromised sites, Wordfence has provided a guide on their website.

Conclusion

This attack highlights the importance of constant vigilance and prompt response to security alerts. Users are encouraged to stay updated on plugin security and adopt best practices for managing WordPress sites to mitigate such risks.

For more details, visit the original Wordfence blog post.

Pietro Melillo
Head of the Dark Lab group. A Computer Engineer specialised in Cyber Security with a deep passion for Hacking and technology, currently CISO of WURTH Italia, he was responsible for Cyber Threat Intelligence & Dark Web analysis services at IBM, carries out research and teaching activities on Cyber Threat Intelligence topics at the University of Sannio, as a Ph.D, author of scientific papers and development of tools to support cybersecurity activities. Leads the CTI Team "RHC DarkLab"