Today's cybersecurity headlines are brought to you by ThreatPerspective

Biz & IT Ars Technica

Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack

Malicious updates available from create attacker-controlled admin account.

Stylized illustration a door that opens onto a wall of computer code.
Enlarge (credit: Getty Images)

WordPress plugins running on as many as 36,000 websites have been backdoored in a supply-chain attack with unknown origins, security researchers said on Monday.

So far, five plugins are known to be affected in the campaign, which was active as recently as Monday morning, researchers from security firm Wordfence reported. Over the past week, unknown threat actors have added malicious functions to updates available for the plugins on, the official site for the open source WordPress CMS software. When installed, the updates automatically create an attacker-controlled administrative account that provides full control over the compromised site. The updates also add content designed to goose search results.

Poisoning the well

“The injected malicious code is not very sophisticated or heavily obfuscated and contains comments throughout making it easy to follow,” the researchers wrote. “The earliest injection appears to date back to June 21st, 2024, and the threat actor was still actively making updates to plugins as recently as 5 hours ago.”

Read 6 remaining paragraphs | Comments

Published: 2024-06-24T21:00:43

© Ethical Hacking News . All rights reserved.

Privacy | Terms of Use | Contact Us