4000+ WordPress Websites Compromised – Dual Threat Analysis

Recent WordPress Hacking incidents have revealed a widespread compromise of WordPress sites, leveraging vulnerabilities in popular plugins to execute malicious activities. This article synthesizes the key elements from two significant reports, highlighting the exploitation methods, impact, and mitigation strategies.

WP Plugin Vulnerability and Exploitation

• Plugins Involved: The “Popup Builder” plugin is notably affected, with its older versions containing a critical cross-site scripting (XSS) vulnerability (CVE-2023-6000). Another major vulnerability was found in the “Ultimate Member” plugin.
• Attack Methods: Attackers inject malicious code into Custom JavaScript or CSS sections within the WordPress admin interface. This code is stored in the ‘wp_postmeta’ database table and facilitates malware redirections to phishing and spam sites.

Impact on Sites

• Scope of Compromise: Over 3,300 WordPress sites using the “Popup Builder” plugin are compromised. The “Ultimate Member” plugin’s bug affected thousands more, leading to unauthorized access and control.
• Visitor Exploitation: Compromised sites abuse visitors’ browsers, enlisting them in distributed brute-force attacks against other sites. “The attacks manifest as distributed brute-force assaults, targeting WordPress websites through the browsers of innocent and unsuspecting visitors,” stated a security researcher from WP Hacked Help . For every password in the list, the visitor’s browser sends a wp.uploadFile XML-RPC API request to upload a file with encrypted credentials used for authentication,” explained a WordPress security researcher. “If authentication succeeds, a small text file with valid credentials is created in the WordPress uploads directory.”
• a new SocGholish (aka FakeUpdates) malware campaign is also targeting WordPress websites in which the JavaScript malware is distributed via modified versions of legitimate plugins that are installed by taking advantage of compromised admin credentials.

Mitigation Strategies

• Immediate Updates: Users are urged to update to the latest versions of affected plugins. For “Popup Builder,” version 4.2.7 is critical.
• Domain Blocking: Blocking malicious domains such as “ttincoming.traveltraffic[.]cc” and “host.cloudsonicwave[.]com” is advised.
• Cleanup and Monitoring: Sites must remove injected code, perform thorough scans, and continuously monitor for suspicious activity.

Broader Implications

• Security Research: Firms like Sucuri and Wordfence have conducted detailed analyses, underscoring the importance of regular plugin updates and proactive security measures.
• Preventive Measures: Emphasis on maintaining updated plugins, conducting regular security audits, and educating site administrators on potential threats.

Conclusion

The recent wave of WordPress site compromises underscores the critical need for vigilant security practices. By staying informed about vulnerabilities and implementing recommended mitigation strategies, site owners can significantly reduce the risk of exploitation. Regular updates, domain blocking, and thorough monitoring are essential components of a robust security posture.