{"id":506,"date":"2024-06-24T23:28:34","date_gmt":"2024-06-24T23:28:34","guid":{"rendered":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/06\/24\/thousands-of-wordpress-sites-compromised-via-wordpress-plugin-bug-sc-media\/"},"modified":"2024-06-24T23:28:34","modified_gmt":"2024-06-24T23:28:34","slug":"thousands-of-wordpress-sites-compromised-via-wordpress-plugin-bug-sc-media","status":"publish","type":"post","link":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/06\/24\/thousands-of-wordpress-sites-compromised-via-wordpress-plugin-bug-sc-media\/","title":{"rendered":"Thousands of WordPress sites compromised via WordPress plugin bug &#8211; SC Media"},"content":{"rendered":"<p>More than 3,300&nbsp;<a href=\"https:\/\/www.scmagazine.com\/brief\/follow-on-distributed-brute-force-attacks-conducted-via-compromised-wordpress-sites\" target=\"_blank\" id=\"\" rel=\"noreferrer noopener\">WordPress<\/a>&nbsp;websites using old iterations of the Popup Builder plugin vulnerable to the cross-site scripting bug, tracked as CVE-2023-6000, have been breached in a new malware campaign, reports&nbsp;<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-exploit-wordpress-plugin-flaw-to-infect-3-300-sites-with-malware\/\" target=\"_blank\" id=\"\" rel=\"noreferrer noopener\">BleepingComputer<\/a>.<br \/>Attackers exploited the vulnerability to facilitate malicious code injections into the WordPress admin interface&#8217;s Custom JavaScript or Custom CSS sections, with the code stored in the &#8216;wp_postmeta&#8217; database table, according to a report from Sucuri. Despite the presence of several code injection variants for different plugin events, all injections were noted to facilitate redirections to malware downloading and phishing websites, said researchers. With more than 80,000 sites still leveraging outdated Popup Builder versions, website owners have been urged to not only immediately update to version 4.2.7 of the plugin but also block the &#8220;ttincoming.traveltraffic[.]cc&#8221; and &#8220;host.cloudsonicwave[.]com&#8221; domains to circumvent attacks. On the other hand, already compromised websites should have the malicious code from the plugin&#8217;s custom sections removed and scanned, researchers added.<br \/><span itemscope=\"\" itemtype=\"https:\/\/schema.org\/Person\" itemprop=\"author\" class=\"me-2\"><a itemprop=\"url\" rel=\"author\" href=\"\/contributor\/sc-staff\"><span itemprop=\"name\"><span itemprop=\"givenName\">SC<!-- --> <\/span><span itemprop=\"familyName\">Staff<\/span><\/span><\/a><\/span><time class=\"non-interactive\" datetime=\"2024-06-24T09:14:00.000-04:00\">June 24, 2024<\/time><br \/>Information claimed to have been exfiltrated included full names, birthdates, gender, birthdates, email addresses, usernames, and hashed passwords.<br \/><span itemscope=\"\" itemtype=\"https:\/\/schema.org\/Person\" itemprop=\"author\" class=\"me-2\"><a itemprop=\"url\" rel=\"author\" href=\"\/contributor\/sc-staff\"><span itemprop=\"name\"><span itemprop=\"givenName\">SC<!-- --> <\/span><span itemprop=\"familyName\">Staff<\/span><\/span><\/a><\/span><time class=\"non-interactive\" datetime=\"2024-06-20T11:18:00.000-04:00\">June 20, 2024<\/time><br \/>SecurityWeek reports that escalating exploitation of VPN vulnerabilities to facilitate significant cyber incidents has prompted the FBI, Cybersecurity and Infrastructure Security Agency, the Canadian Centre for Cyber Security, and New Zealand&#8217;s Government Communications Security Bureau and CERT to establish new guidance urging the move to more robust alternatives, such as Secure Service Edge and Secure Access Service Edge solutions.<br \/><span itemscope=\"\" itemtype=\"https:\/\/schema.org\/Person\" itemprop=\"author\" class=\"me-2\"><a itemprop=\"url\" rel=\"author\" href=\"\/contributor\/sc-staff\"><span itemprop=\"name\"><span itemprop=\"givenName\">SC<!-- --> <\/span><span itemprop=\"familyName\">Staff<\/span><\/span><\/a><\/span><time class=\"non-interactive\" datetime=\"2024-06-19T07:47:00.000-04:00\">June 19, 2024<\/time><br \/>Attackers launched reconnaissance and privilege escalation attacks against Docker APIs with an exposed port 2375 before executing a trio of shell scripts.<br \/><meta itemprop=\"startDate\" content=\"2024-02-28T14:00:00.000-05:00\"\/><meta itemprop=\"endDate\" content=\"2024-02-28T15:00:00.000-05:00\"\/><span class=\"text-small text-muted font-weight-semibold non-interactive\">On-Demand Event<\/span><br \/><meta itemprop=\"startDate\" content=\"2024-01-18T14:00:00.000-05:00\"\/><meta itemprop=\"endDate\" content=\"2024-01-18T15:00:00.000-05:00\"\/><span class=\"text-small text-muted font-weight-semibold non-interactive\">On-Demand Event<\/span><br \/><meta itemprop=\"startDate\" content=\"2024-01-04T13:00:00.000-05:00\"\/><meta itemprop=\"endDate\" content=\"2024-01-04T14:00:00.000-05:00\"\/><span class=\"text-small text-muted font-weight-semibold non-interactive\">On-Demand Event<\/span><\/p>\n<p>By clicking the Subscribe button below, you agree to SC Media <a class=\"text-underline\" target=\"_blank\" href=\"https:\/\/www.cyberriskalliance.com\/terms-of-use\" rel=\"noopener\">Terms and Conditions<\/a><span> and <\/span><a class=\"text-underline\" target=\"_blank\" href=\"https:\/\/www.cyberriskalliance.com\/terms-of-use#privacy-policy\" rel=\"noopener\">Privacy Policy<\/a>.<\/p>\n<p>         Copyright \u00a9 2024 CyberRisk Alliance, LLC All Rights Reserved.         This material may not be published, broadcast, rewritten or redistributed         in any form without prior authorization.       <br \/><span>Your use of this website constitutes acceptance of CyberRisk Alliance <\/span><a class=\"text-underline cursor-pointer\" target=\"_blank\" href=\"https:\/\/www.cyberriskalliance.com\/terms-of-use#privacy-policy\" rel=\"noopener\">Privacy Policy<\/a><span> and <\/span><a class=\"text-underline cursor-pointer\" target=\"_blank\" href=\"https:\/\/www.cyberriskalliance.com\/terms-of-use\" rel=\"noopener\">Terms &amp; Conditions<\/a><span>.<\/span><\/p>\n<p><a href=\"https:\/\/news.google.com\/rss\/articles\/CBMiYmh0dHBzOi8vd3d3LnNjbWFnYXppbmUuY29tL2JyaWVmL3Rob3VzYW5kcy1vZi13b3JkcHJlc3Mtc2l0ZXMtY29tcHJvbWlzZWQtdmlhLXdvcmRwcmVzcy1wbHVnaW4tYnVn0gEA?oc=5\">source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>More than 3,300&nbsp;WordPress&nbsp;websites using old iterations of the Popup Builder plugin vulnerable to the cross-site scripting bug, tracked as CVE-2023-6000, have been breached in a new malware campaign, reports&nbsp;BleepingComputer.Attackers exploited the vulnerability to facilitate malicious code injections into the WordPress admin interface&#8217;s Custom JavaScript or Custom CSS sections, with the&hellip;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-506","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/comments?post=506"}],"version-history":[{"count":0,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/506\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/media?parent=506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/categories?post=506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/tags?post=506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}