Researchers at Defiant, the company behind the Wordfence security plugin for WordPress websites, have come across a malvertising campaign that leverages recently disclosed plugin vulnerabilities to inject malicious code into websites.
The hackers have been using flaws in WordPress plugins such as “Coming Soon and Maintenance Mode,” “Yellow Pencil Visual CSS Style Editor” and “Blog Designer” to achieve their goals. Each of these plugins has thousands or tens of thousands of active installations.
According to Defiant, the attackers are exploiting these vulnerabilities to inject a small piece of JavaScript code into affected WordPress websites. The script is designed to fetch additional code from an external domain and execute that code when a user visits the compromised website.
Victims are first redirected to a domain that checks the type of device they are using and, based on that and other factors, redirects them to one of several types of malicious or scammy destinations, including tech support scams, shady pharma ads, and malicious Android APKs. In some cases, the exploit targets the user’s browser directly and attempts to convince them to click on various things.
The attackers have exploited stored cross-site scripting (XSS) vulnerabilities in Blog Designer and Coming Soon and Maintenance Mode, and an unauthenticated arbitrary options update weakness in the Yellow Pencil plugin.
The Yellow Pencil flaw was first exploited in April, just days after a researcher disclosed its details and published a proof-of-concept (PoC). This vulnerability can be highly useful for attackers as it allows them to create new admin users, enabling them to easily take control of a WordPress site.
“The majority of the XSS injection attempts tracked across this campaign were sent by IP addresses linked to popular hosting providers,” explained Defiant’s Mikey Veenstra. “With attacks sourced from IPs hosting several live websites, as well as our own evidence of infected sites associated with this campaign, it’s likely the threat actor is using infected sites to deliver XSS attacks by proxy.”
Defiant’s blog post contains indicators of compromise (IoC) that can be useful to defenders.
Related: Zero-Days in WordPress Plugin Actively Exploited
Related: Hackers Exploit Flaw in GDPR Compliance Plugin for WordPress
Related: Hackers Target WordPress Sites via WP Cost Estimation Plugin
Related: Former Employee Hacks Popular WordPress Plugin’s Website