Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Recently Disclosed WordPress Plugin Flaws Exploited in Malvertising Operation

Researchers at Defiant, the company behind the Wordfence security plugin for WordPress websites, have come across a malvertising campaign that leverages recently disclosed plugin vulnerabilities to inject malicious code into websites.

Researchers at Defiant, the company behind the Wordfence security plugin for WordPress websites, have come across a malvertising campaign that leverages recently disclosed plugin vulnerabilities to inject malicious code into websites.

The hackers have been using flaws in WordPress plugins such as “Coming Soon and Maintenance Mode,” “Yellow Pencil Visual CSS Style Editor” and “Blog Designer” to achieve their goals. Each of these plugins has thousands or tens of thousands of active installations.

According to Defiant, the attackers are exploiting these vulnerabilities to inject a small piece of JavaScript code into affected WordPress websites. The script is designed to fetch additional code from an external domain and execute that code when a user visits the compromised website.

Victims are first redirected to a domain that checks the type of device they are using and, based on that and other factors, redirects them to one of several types of malicious or scammy destinations, including tech support scams, shady pharma ads, and malicious Android APKs. In some cases, the exploit targets the user’s browser directly and attempts to convince them to click on various things.

The attackers have exploited stored cross-site scripting (XSS) vulnerabilities in Blog Designer and Coming Soon and Maintenance Mode, and an unauthenticated arbitrary options update weakness in the Yellow Pencil plugin.

The Yellow Pencil flaw was first exploited in April, just days after a researcher disclosed its details and published a proof-of-concept (PoC). This vulnerability can be highly useful for attackers as it allows them to create new admin users, enabling them to easily take control of a WordPress site.

“The majority of the XSS injection attempts tracked across this campaign were sent by IP addresses linked to popular hosting providers,” explained Defiant’s Mikey Veenstra. “With attacks sourced from IPs hosting several live websites, as well as our own evidence of infected sites associated with this campaign, it’s likely the threat actor is using infected sites to deliver XSS attacks by proxy.”

Defiant’s blog post contains indicators of compromise (IoC) that can be useful to defenders.

Advertisement. Scroll to continue reading.

Related: Zero-Days in WordPress Plugin Actively Exploited

Related: Hackers Exploit Flaw in GDPR Compliance Plugin for WordPress

Related: Hackers Target WordPress Sites via WP Cost Estimation Plugin

Related: Former Employee Hacks Popular WordPress Plugin’s Website

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...