Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?



Recently Disclosed WordPress Plugin Flaws Exploited in Malvertising Operation

Researchers at Defiant, the company behind the Wordfence security plugin for WordPress websites, have come across a malvertising campaign that leverages recently disclosed plugin vulnerabilities to inject malicious code into websites.

Researchers at Defiant, the company behind the Wordfence security plugin for WordPress websites, have come across a malvertising campaign that leverages recently disclosed plugin vulnerabilities to inject malicious code into websites.

The hackers have been using flaws in WordPress plugins such as “Coming Soon and Maintenance Mode,” “Yellow Pencil Visual CSS Style Editor” and “Blog Designer” to achieve their goals. Each of these plugins has thousands or tens of thousands of active installations.

According to Defiant, the attackers are exploiting these vulnerabilities to inject a small piece of JavaScript code into affected WordPress websites. The script is designed to fetch additional code from an external domain and execute that code when a user visits the compromised website.

Victims are first redirected to a domain that checks the type of device they are using and, based on that and other factors, redirects them to one of several types of malicious or scammy destinations, including tech support scams, shady pharma ads, and malicious Android APKs. In some cases, the exploit targets the user’s browser directly and attempts to convince them to click on various things.

The attackers have exploited stored cross-site scripting (XSS) vulnerabilities in Blog Designer and Coming Soon and Maintenance Mode, and an unauthenticated arbitrary options update weakness in the Yellow Pencil plugin.

The Yellow Pencil flaw was first exploited in April, just days after a researcher disclosed its details and published a proof-of-concept (PoC). This vulnerability can be highly useful for attackers as it allows them to create new admin users, enabling them to easily take control of a WordPress site.

“The majority of the XSS injection attempts tracked across this campaign were sent by IP addresses linked to popular hosting providers,” explained Defiant’s Mikey Veenstra. “With attacks sourced from IPs hosting several live websites, as well as our own evidence of infected sites associated with this campaign, it’s likely the threat actor is using infected sites to deliver XSS attacks by proxy.”

Advertisement. Scroll to continue reading.

Defiant’s blog post contains indicators of compromise (IoC) that can be useful to defenders.

Related: Zero-Days in WordPress Plugin Actively Exploited

Related: Hackers Exploit Flaw in GDPR Compliance Plugin for WordPress

Related: Hackers Target WordPress Sites via WP Cost Estimation Plugin

Related: Former Employee Hacks Popular WordPress Plugin’s Website

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.