WordPress: Five Plugins Found with Malicious Code

Pietro Melillo : 25 June 2024 14:03

On June 24, 2024, Wordfence revealed a supply chain attack on WordPress plugins, leading to the compromise of five plugins with malicious code. The affected plugins are:

1. Social Warfare (versions 4.4.6.4 to 4.4.7.1)
2. Blaze Widget (versions 2.2.5 to 2.5.2)
3. Wrapper Link Element (versions 1.0.2 to 1.0.3)
4. Contact Form 7 Multi-Step Addon (versions 1.0.4 to 1.0.5)
5. Simply Show Hooks (version 1.2.1)

The malicious code aimed to create a new admin user and inject SEO spam into site footers. The compromised versions are no longer listed in the WordPress repository.

Attack Details

The attack was detected by Wordfence while analyzing the Social Warfare plugin, following a forum post by the WordPress Plugin Review team. Further investigation revealed that four more plugins were similarly compromised. The malware attempted to create an unauthorized admin account and send credentials to an attacker-controlled server, in addition to adding SEO spam via malicious JavaScript.

Response and Recommendations

Vuoi diventare un esperto del Dark Web e della Cyber Threat Intelligence (CTI)?
Stiamo per avviare il corso intermedio in modalità "Live Class", previsto per febbraio.
A differenza dei corsi in e-learning, disponibili online sulla nostra piattaforma con lezioni pre-registrate, i corsi in Live Class offrono un’esperienza formativa interattiva e coinvolgente.
Condotti dal professor Pietro Melillo, le lezioni si svolgono online in tempo reale, permettendo ai partecipanti di interagire direttamente con il docente e approfondire i contenuti in modo personalizzato. Questi corsi, ideali per aziende, consentono di sviluppare competenze mirate, affrontare casi pratici e personalizzare il percorso formativo in base alle esigenze specifiche del team, garantendo un apprendimento efficace e immediatamente applicabile.
Non perdere i nostri corsi e scrivi subito su WhatsApp al numero
379 163 8765  per richiedere informazioni "

Supporta RHC attraverso:

• L'acquisto del fumetto sul Cybersecurity Awareness
• Ascoltando i nostri Podcast
• Seguendo RHC su WhatsApp
• Seguendo RHC su Telegram
• Scarica gratuitamente "Dark Mirror", il report sul ransomware di Dark Lab

Ti piacciono gli articoli di Red Hot Cyber? Non aspettare oltre, iscriviti alla newsletter settimanale per non perdere nessun articolo.

Wordfence advised users to:

• Check for Indicators of Compromise: Including unauthorized admin accounts and connections to IP address 94.156.79.8.
• Remove Compromised Plugins: Until a safe version is confirmed, users should remove the affected plugins.
• Perform a Full Security Audit: Using tools like Wordfence’s Vulnerability Scanner or CLI.

For detailed steps on securing compromised sites, Wordfence has provided a guide on their website.

Conclusion

This attack highlights the importance of constant vigilance and prompt response to security alerts. Users are encouraged to stay updated on plugin security and adopt best practices for managing WordPress sites to mitigate such risks.

For more details, visit the original Wordfence blog post.

Pietro Melillo
Head of the Dark Lab group. A Computer Engineer specialised in Cyber Security with a deep passion for Hacking and technology, currently CISO of WURTH Italia, he was responsible for Cyber Threat Intelligence & Dark Web analysis services at IBM, carries out research and teaching activities on Cyber Threat Intelligence topics at the University of Sannio, as a Ph.D, author of scientific papers and development of tools to support cybersecurity activities. Leads the CTI Team "RHC DarkLab"