WordPress: Five Plugins Found with Malicious Code

Pietro Melillo : 25 June 2024 14:03

On June 24, 2024, Wordfence revealed a supply chain attack on WordPress plugins, leading to the compromise of five plugins with malicious code. The affected plugins are:

1. Social Warfare (versions 4.4.6.4 to 4.4.7.1)
2. Blaze Widget (versions 2.2.5 to 2.5.2)
3. Wrapper Link Element (versions 1.0.2 to 1.0.3)
4. Contact Form 7 Multi-Step Addon (versions 1.0.4 to 1.0.5)
5. Simply Show Hooks (version 1.2.1)

The malicious code aimed to create a new admin user and inject SEO spam into site footers. The compromised versions are no longer listed in the WordPress repository.

Attack Details

The attack was detected by Wordfence while analyzing the Social Warfare plugin, following a forum post by the WordPress Plugin Review team. Further investigation revealed that four more plugins were similarly compromised. The malware attempted to create an unauthorized admin account and send credentials to an attacker-controlled server, in addition to adding SEO spam via malicious JavaScript.

Response and Recommendations

Acquista il corso Dark Web & Cyber Threat Intelligence (e-learning version)
Il Dark Web e la Cyber Threat Intelligence rappresentano aree critiche per comprendere le minacce informatiche moderne. Tra ransomware, data breach e attività illecite, le organizzazioni devono affrontare sfide sempre più complesse per proteggere i propri dati e le infrastrutture. Il nostro corso “Dark Web & Cyber Threat Intelligence” ti guiderà attraverso i meccanismi e le strategie utilizzate dai criminali informatici, fornendoti competenze pratiche per monitorare, analizzare e anticipare le minacce.

Accedi alla pagina del corso condotto dall'Prof. Pietro Melillo sulla nostra Academy e segui l'anteprima gratuita.

Per un periodo limitato, potrai utilizzare il COUPON CTI-16253 che ti darà diritto ad uno sconto del 20% sul prezzo di copertina del corso
Per ulteriori informazioni, scrivici ad [email protected] oppure scrivici su Whatsapp al 379 163 8765 

Supporta RHC attraverso:

• L'acquisto del fumetto sul Cybersecurity Awareness
• Seguendo RHC su WhatsApp
• Seguendo RHC su Telegram
• Scarica gratuitamente "Dark Mirror", il report sul ransomware di Dark Lab

Ti piacciono gli articoli di Red Hot Cyber? Non aspettare oltre, iscriviti alla newsletter settimanale per non perdere nessun articolo

Wordfence advised users to:

• Check for Indicators of Compromise: Including unauthorized admin accounts and connections to IP address 94.156.79.8.
• Remove Compromised Plugins: Until a safe version is confirmed, users should remove the affected plugins.
• Perform a Full Security Audit: Using tools like Wordfence’s Vulnerability Scanner or CLI.

For detailed steps on securing compromised sites, Wordfence has provided a guide on their website.

Conclusion

This attack highlights the importance of constant vigilance and prompt response to security alerts. Users are encouraged to stay updated on plugin security and adopt best practices for managing WordPress sites to mitigate such risks.

For more details, visit the original Wordfence blog post.

Pietro Melillo
Head of the Dark Lab group. A Computer Engineer specialised in Cyber Security with a deep passion for Hacking and technology, currently CISO of WURTH Italia, he was responsible for Cyber Threat Intelligence & Dark Web analysis services at IBM, carries out research and teaching activities on Cyber Threat Intelligence topics at the University of Sannio, as a Ph.D, author of scientific papers and development of tools to support cybersecurity activities. Leads the CTI Team "RHC DarkLab"