Wordfence Threat Intelligence team identified a significant security breach involving multiple WordPress plugins.
The initial discovery was made when the team found that the Social Warfare plugin had been injected with malicious code on June 22nd, 2024.
This discovery was based on a forum post by the WordPress.org Plugin Review team.
Upon further investigation, Wordfence identified four additional plugins that were similarly compromised.Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan
The affected plugins include:
Wordfence has contacted the WordPress plugins team to alert them about the compromised plugins.
Although there has been no official response, the affected plugins have been delisted.
Users are advised to update the patched versions where available or remove the plugins entirely if no patch exists.
The injected malware attempts to create a new administrative user account and sends the details to an attacker-controlled server.
Additionally, malicious JavaScript is injected into the website’s footer, adding SEO spam.
The malware is not heavily obfuscated, making it easy to follow and remove.
The Wordfence team is conducting a deeper analysis and developing malware signatures to detect these compromised plugins.
The Wordfence Vulnerability Scanner will notify users running the affected versions.
Immediate steps include checking for unauthorized administrative accounts and running a complete malware scan using the Wordfence plugin or CLI.
Indicators of Compromise:
If you have any of these plugins installed, consider your site compromised and take immediate action.
For detailed guidance on cleaning your WordPress site, visit the Wordfence website or sign up for their incident response services.
Stay vigilant and ensure your WordPress installations are secure to prevent further exploitation.Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free
71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:
<
ul>
Stay safe online with free daily cybersecurity updates. Sign up now!
GBHackers on security is a highly informative and reliable Cyber Security News platform that provides the latest and most relevant updates on Cyber Security News, Hacking News, Technology advancements, and Kali Linux tutorials on a daily basis. The platform is dedicated to keeping the community well-informed and up-to-date with the constantly evolving Cyber World.
Email : [email protected]
Leave a Reply