WordPress plugins running on as many as 36,000 websites have been backdoored in a supply-chain attack with unknown origins, security researchers said on Monday.
So far, five plugins are known to be affected in the campaign, which was active as recently as Monday morning, researchers from security firm Wordfence reported. Over the past week, unknown threat actors have added malicious functions to updates available for the plugins on WordPress.org, the official site for the open source WordPress CMS software. When installed, the updates automatically create an attacker-controlled administrative account that provides full control over the compromised site. The updates also add content designed to goose search results.
Poisoning the well
“The injected malicious code is not very sophisticated or heavily obfuscated and contains comments throughout making it easy to follow,” the researchers wrote. “The earliest injection appears to date back to June 21st, 2024, and the threat actor was still actively making updates to plugins as recently as 5 hours ago.”
The five plugins are:
- Social Warfare (https://wordpress.org/plugins/social-warfare/) - 30,000 installs
- BLAZE Retail Widget (https://wordpress.org/plugins/blaze-widget/) - 10 installs
- Wrapper Link Elementor (https://wordpress.org/plugins/wrapper-link-elementor/) - 1,000 installs
- Contact Form 7 Multi-Step Addon (https://wordpress.org/plugins/contact-form-7-multi-step-addon/) - 700 installs
- Simply Show Hooks (https://wordpress.org/plugins/simply-show-hooks/) - 4,000 installs
Over the past decade, supply-chain attacks have evolved into one of the most effective vectors for installing malware. By poisoning software at the very source, threat actors can infect large numbers of devices when users do nothing more than run a trusted update or installation file. Earlier this year, disaster was narrowly averted after a backdoor planted in the widely used open source XZ Utils code library was discovered, largely by luck, a week or two before it was scheduled for general release. Examples of other recent supply-chain attacks abound.
If you look at the App that has 30K It has 1.7 Million Downloads for its lifetime. It must of sucked but given that it is a backdoor. They probably put in the malicious code in and took it out multiple times. Given that most people don't have plug-ins as auto update on wordpress. Putting in and taking out the code constantly would be the best way to hide and be able to exploit sites.