{"id":1005,"date":"2024-07-05T22:39:30","date_gmt":"2024-07-05T22:39:30","guid":{"rendered":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/07\/05\/wordpress-fights-off-malware-attack-5-plugins-infected-mssp-alert\/"},"modified":"2024-07-05T22:39:30","modified_gmt":"2024-07-05T22:39:30","slug":"wordpress-fights-off-malware-attack-5-plugins-infected-mssp-alert","status":"publish","type":"post","link":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/07\/05\/wordpress-fights-off-malware-attack-5-plugins-infected-mssp-alert\/","title":{"rendered":"WordPress Fights Off Malware Attack, 5 Plugins Infected – MSSP Alert"},"content":{"rendered":"

Credit: Adobe Stock Images
Considering that many MSSPs and MSPs manage WordPress sites for their customers, news of a malware injection into five WordPress plugins raises concern about the vulnerability of this common website content creation software.
The software supply chain attack backdoors malicious code that makes it possible to create rogue administrator accounts, with the aim of performing arbitrary actions, The Hacker News reports. The break-in established malicious admin accounts with the “Options” and “PluginAuth” usernames, enabling the exfiltration of account details to the IP address 94.156.79[.]8.
Attackers also conducted malicious JavaScript code injections to infect targeted websites with search engine optimization spam, Defiant<\/a>\u2019s Wordfence security researcher Chloe Chamberland blogged<\/a>. All of the affected plugins have already been removed from the WordPress plugin directory. Only Social Warfare has issued a new version addressing the issue. Immediate deletion of the plugins has also been recommended to website admins.
Now, on top of malware, a new credit card skimmer \u201cCaesar Cipher Skimmer\u201d is infecting multiple content management platforms, including WordPress, Magento and OpenCart, Ben Martin<\/a> of Securi reports<\/a>.<\/p>\n

The plugins in question are no longer available for download from the WordPress plugin directory pending ongoing review. Wordfense offers a full guide to cleaning your WordPress site<\/a> and associated patches<\/a>.
Wordfense lists the infected plugins:<\/p>\n

The Wordfence Threat Intelligence team is performing a deeper analysis and will provide more information as it becomes available.
\u201cWe are actively working on a set of malware signatures to provide detection for these compromised plugins,\u201d Chamberland said. \u201cHowever, if you are running a malicious version of one of the plugins, you will be notified by the Wordfence Vulnerability Scanner that you have a vulnerability on your site<\/a> and you should update the plugin where available or remove it ASAP.\u201d
The Word Press attack brings to light new research from Sonatype\u2019s 9th<\/sup> Annual State of the Software Supply Chain Report<\/a>, which uncovered a whopping 633% increase in software supply chain attacks.
Jim Masters is Managing Editor of MSSP Alert, and holds a B.A. degree in Journalism from Northern Illinois University. His career has spanned governmental and investigative reporting for daily newspapers in the Northwest Indiana Region and 16 years in a global internal communications role for a Fortune 500 professional services company. Additionally, he is co-owner of the Lake County Corn Dogs minor league baseball franchise, located in Crown Point, Indiana. In his spare time, he enjoys writing and recording his own music, oil painting, biking, volleyball, golf and cheering on the Corn Dogs.
Sponsored by <\/span>Stellar Cyber<\/span><\/span><\/a><\/span>D. <\/span>Howard Kass<\/span><\/span><\/a><\/span>Jim <\/span>Masters<\/span><\/span><\/a><\/span>

source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit: Adobe Stock ImagesConsidering that many MSSPs and MSPs manage WordPress sites for their customers, news of a malware injection into five WordPress plugins raises concern about the vulnerability of this common website content creation software.The software supply chain attack backdoors malicious code that makes it possible to create rogue…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1005","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/1005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/comments?post=1005"}],"version-history":[{"count":0,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/1005\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/media?parent=1005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/categories?post=1005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/tags?post=1005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}