Many WordPress have been used to insert malicious code, allowing hackers to create fake administrator accounts with the aim of performing arbitrary actions.
“The malware attempts to create a new administrator account and then sends those details to a server controlled by hackers,” Wordfence security researcher Chloe Chamberland said on Monday. “In addition, it appears that the threat actor has injected malicious JavaScript into the footer of the websites, adding SEO spam to the entire site.”
See also: Hackers exploit Deskky Snippets WordPress Plugin and steal credit card details
The administrator accounts have the usernames “Options” and “PluginAuth”, and the information is sent to the IP address 94.156.79[.]8.
It is still unknown how the hackers managed to compromise the WordPress plugins. However, the first signs of the attack on the software supply chain were observed as early as June 21, 2024.
These WordPress plugins are no longer available for download from the WordPress plugin directory, pending ongoing review.
Social Warfare 4.4.6.4 – 4.4.7.1 (Updated version: 4.4.7.3) – 30,000+ installations
Blaze Widget 2.2.5 – 2.5.2 (Updated version: N/A) – 10+ installations
Wrapper Link Element 1.0.2 – 1.0.3 (Updated version: N/A) – 1,000+ installations
Contact Form 7 Multi-Step Addon 1.0.4 – 1.0.5 (Updated version: N/A) – 700+ installations
Simply Show Hooks 1.2.1 (Updated version: N/A) – 4,000+ installations
Read also: Critical vulnerabilities in WooCommerce Amazon Affiliates plugin
Users of the aforementioned plugins are advised to check their websites for suspicious administrator accounts and delete them, as well as remove any malicious code they detect.
Source: thehackernews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
