A threat actor modified the source code of at least five plugins hosted on WordPress.org to include malicious PHP scripts that create new accounts with administrative privileges on websites running them.
The attack was discovered by the Wordfence Threat Intelligence team yesterday, but the malicious injections appear to have occurred towards the end of last week, between June 21 and June 22.
As soon as Wordfence discovered the breach, the company notified the plugin developers, which resulted in patches being released yesterday for most of the products.
Together, the five plugins have been installed on more than 35,000 websites:
- Social Warfare 4.4.6.4 to 4.4.7.1 (fixed in version 4.4.7.3)
- Blaze Widget 2.2.5 to 2.5.2 (fixed in version 2.5.4)
- Wrapper Link Element 1.0.2 to 1.0.3 (fixed in version 1.0.5)
- Contact Form 7 Multi-Step Addon 1.0.4 to 1.0.5 (fixed in version 1.0.7)
- Simply Show Hooks 1.2.1 to 1.2.2 (no fix available yet)
Wordfence notes that it does not know how the threat actor managed to gain access to the source code of the plugins but an investigation is looking into it.
Although it is possible that the attack impacts a larger number of WordPress plugins, current evidence suggests that the compromise is limited to the aforementioned set of five.
Backdoor operation and IoCs
The malicious code in the infected plugins attempts to create new admin accounts and inject SEO spam into the compromised website.
“At this stage, we know that the injected malware attempts to create a new administrative user account and then sends those details back to the attacker-controlled server,” explains Wordfence.
“In addition, it appears the threat actor also injected malicious JavaScript into the footer of websites that appears to add SEO spam throughout the website.”
The data is transmitted to the IP address 94.156.79[.]8, while the arbitrarily created admin accounts are named “Options” and “PluginAuth,” the researchers say.
Website owners that notice such accounts or traffic to the attacker's IP address should perform a complete malware scan and cleanup.
Wordfence notes that some of the impacted plugins were temporarily delisted from WordPress.org, which may result in users getting warnings even if they use a patched version.
Comments
PluginVulns - 5 days ago
Why are you claiming that Wordfence discovered this? According to the beginning of their post you cited, they said they became aware of this because of a public post by the WordPress.org Plugin Review team:
On Monday June 24th, 2024 the Wordfence Threat Intelligence team became aware of a plugin, Social Warfare, that was injected with malicious code on June 22, 2024 based on a forum post by the WordPress.org Plugin Review team.
In turn, that team says they were notified by someone else.
PluginVulns - 4 days ago
We have put together details on the situation, including what access the attacker had to update the plugins and that logging shows they had access to update one of the plugins starting in March. That can be found at https://www.pluginvulnerabilities.com/2024/06/26/attacker-adding-malicious-code-to-legitimate-wordpress-plugins-in-plugin-directory-quickly-caught/