If you are a WordPress site admin, be wary of incoming emails – one could be a phishing message looking to infect your site with malicious plugins.
This is the warning given out by WordPress security experts Wordfence and PatchStack, which have found WordPress site admins receiving emails impersonating the legitimate wordpress.com site.
In the emails, the admins were warned of a new (but actually bogus) remote code execution (RCE) flaw and were urged to immediately install a plugin to defend their site from hackers. The non-existent flaw is tracked as CVE-2023-45124, the fraudsters claim.
Injecting WordPress sites with ads
Gullible admins that click the “Download Plugin” button are then redirected to a fake landing page where they can review, and download, the “plugin”. The reviews are a mix of five-star, four-star, and even one-star ratings, to add legitimacy to the whole ordeal. The site also claims the plugin has had more than 500,000 downloads, and comes with reviews that are a mix of praise and critique.
The plugin does a number of malicious things to the infected WordPress instance. Firstly, it creates a hidden admin user, giving the attacker administrative privileges, but also exfiltrates important information about the website to the plugin’s operators, and downloads a backdoor that comes with file management features, an SQL client, a PHP console, and more. Finally, it tries to remain hidden and out of sight, which means admins need to manually search on the site’s root directory for it, in order to find and remove the malware.
While the malicious plugin’s end goal is still unclear at this time, researchers speculate that it could be used to inject unwanted ads on the compromised website. In some scenarios, plugins such as this one were used to redirect visitors to different sites, steal sensitive data, and more.
Via BleepingComputer
