Hackers Exploit Multiple WordPress Plugins to Hack Websites & Create Rogue Admin Accounts

Wordfence Threat Intelligence team identified a significant security breach involving multiple WordPress plugins.

 The initial discovery was made when the team found that the Social Warfare plugin had been injected with malicious code on June 22nd, 2024.

This discovery was based on a forum post by the WordPress.org Plugin Review team.

Upon further investigation, Wordfence identified four additional plugins that were similarly compromised.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

The affected plugins include:

  • Social Warfare (versions 4.4.6.4 – 4.4.7.1)
  • Blaze Widget (versions 2.2.5 – 2.5.2)
  • Wrapper Link Element (versions 1.0.2 – 1.0.3)
  • Contact Form 7 Multi-Step Addon (versions 1.0.4 – 1.0.5)
  • Simply Show Hooks (version 1.2.1)

Immediate Actions and Recommendations

Wordfence has contacted the WordPress plugins team to alert them about the compromised plugins.

Although there has been no official response, the affected plugins have been delisted.

Users are advised to update the patched versions where available or remove the plugins entirely if no patch exists.

The injected malware attempts to create a new administrative user account and sends the details to an attacker-controlled server.

Additionally, malicious JavaScript is injected into the website’s footer, adding SEO spam.

The malware is not heavily obfuscated, making it easy to follow and remove.

Indicators of Compromise and Next Steps

The Wordfence team is conducting a deeper analysis and developing malware signatures to detect these compromised plugins.

The Wordfence Vulnerability Scanner will notify users running the affected versions.

Immediate steps include checking for unauthorized administrative accounts and running a complete malware scan using the Wordfence plugin or CLI.

Indicators of Compromise:

  • Server IP Address: 94.156.79.8
  • Generated Admin Usernames: Options, PluginAuth

If you have any of these plugins installed, consider your site compromised and take immediate action.

For detailed guidance on cleaning your WordPress site, visit the Wordfence website or sign up for their incident response services.

Stay vigilant and ensure your WordPress installations are secure to prevent further exploitation.

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…

22 hours ago

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…

22 hours ago

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…

22 hours ago

HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments

Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…

22 hours ago

RansomHub Ransomware Group Hits 84 Organizations as New Threat Actors Emerge

The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…

22 hours ago

Threat Actors Leverage Email Bombing to Evade Security Tools and Conceal Malicious Activity

Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…

2 days ago