Three more Malicious Backdoored plugins with More than 89,000 Active Installs found in WordPress Repository

WordPress has such a massive ecosystem consist of a number of plugins and themes, threat actors involved in various malicious activities such as hiding the PHP backdoor scripts into the WordPress Security Plugin.

In this incident, the attackers sell existing unsupported plugins to new authors with backdoor code inserted and their goal is to insert SEO spam to the sites with the plugin installed.

Wordfence uncovers the incident and WordPress security team has closed the plugin from the store which means the plugin not available to download from the repository.

There is too many up’s and down’s in WordPress usage, it requires a security improvement, so the WordPress Penetration testing is essential to find the vulnerabilities and to secure your WordPress powered blog.

Malicious WordPress backdoor Plugins

Duplicate Page and Post

The Functionality of the plugin is to create a cloned post or the page, now the Current Owner of the plugin inserted backdoor scripts which makes a request to cloud-wp.org and injects cloaked backlinks to the site.

It has more than 50,000+ Active Installs and the plugins Removed from WordPress.org on December 14, 2017.

No Follow All External Links

Behaviour same as like Duplicate Page and Post this backdoor requests to cloud.wpserve.org and returns content based URLs and the backdoor used in injecting backlinks for SEO.

It has more than 9,000++ Active Installs and the plugins Removed from WordPress.org on December 19, 2017.

WP No External Links

It is same as the previous two backdoors it requests wpconnect.org and returns content based on the URL and the backdoor used in injecting backlinks for SEO.

It has more than 30,000+ Active Installs and the plugins Removed from WordPress.org on December 22, 2017.

Wordfence says Orb Online, paid for both the No Follow External Links and Duplicate Page and Posts plugins and the same threat actor involved in purchasing and injecting backdoors to all three of these plugins with the goal of injecting SEO spam into the thousands of websites running the plugins.

If you have the plugin installed it is highly recommended to uninstall them immediately and scan the website for infection with sucuri and gravity scan.

Thousands of WordPress websites get hacked every day, so securing your blog must be top of mind. Luckily, it’s not all rocket-science as you need to make most of the tweaks only once.Here you can find Most Important Considerations Check to Setup Your WordPress Security.