By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    What is an Exploit? -Kaspersky Daily
    8 months ago
    Darkhotel APT in luxury Asian hotels
    8 months ago
    Kaspersky Lab expert Andrey Pozhogin answers questions about ransomware
    8 months ago
    Latest News
    Triangulation: Trojan for iOS | Kaspersky official blog
    5 days ago
    Wordfence Intelligence Weekly WordPress Vulnerability Report (May 22, 2023 to May 28, 2023)
    5 days ago
    Safeguards against firmware signed with stolen MSI keys
    7 days ago
    WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
    7 days ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    Keylogger found on 5500 sites running WordPress
    Keylogger found on 5500 sites running WordPress
    8 months ago
    Windows 11 build 22622.575 (KB5016694) releases in the Beta Channel
    8 months ago
    How to create restore point on Windows 11
    8 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    4 months ago
    Now you can speed up any video in your browser
    4 months ago
    How to restore access to a file after EFS or view it on another computer?
    4 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    5 months ago
  • How To
    How ToShow More
    Nine years of Project Galileo and how the last year has changed it
    Nine years of Project Galileo and how the last year has changed it
    17 hours ago
    Dynamic data collection with Zaraz Worker Variables
    Dynamic data collection with Zaraz Worker Variables
    4 days ago
    Reduce latency and increase cache hits with Regional Tiered Cache
    Reduce latency and increase cache hits with Regional Tiered Cache
    5 days ago
    Cloudflare is deprecating Railgun
    Cloudflare is deprecating Railgun
    5 days ago
    What is two-factor authentication | Kaspersky official blog
    1 week ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    How to add Vkontakte middle name?
    8 months ago
    How to prevent applications from running in the background on Windows 10?
    8 months ago
    Do you know how to reinstall Windows from a flash drive?
    8 months ago
    Latest News
    How to generate SSH keys on Windows 11
    7 hours ago
    How to enable file sharing on WSA for Windows 11
    7 hours ago
    How to add CPU, GPU, RAM widgets on Windows 11
    4 days ago
    How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11
    1 week ago
  • Glossary
  • My Bookmarks
Reading: Vulnerability in popular WordPress plugin exploited to hijack websites
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
ThreatsWordpress Threats

Vulnerability in popular WordPress plugin exploited to hijack websites

Tom Grant
Last updated: 13 October
Tom Grant 2 years ago
Share
4 Min Read

Company Analysts Defiant told about a dangerous vulnerability in the popular WP GDPR Compliance plugin. As the name suggests, this plugin is used to enforce the General Data Protection Regulation (GDPR). It helps to implement all the necessary notifications for users on the site and bring the resource in line with European standards.


Currently, WP GDPR Compliance is one of the most popular solutions of its kind, with over 100,000 active installations.

About three weeks ago, attackers discovered a flaw in WP GDPR Compliance and started using it to inject backdoor scripts on vulnerable sites. But initially, messages about the compromise appeared on the support forums for another plugin. As it turned out later, this plugin was used on some hacked sites as a payload of the second stage of infection. And the source of the hacks, as mentioned above, was precisely WP GDPR Compliance.


Last week the WordPress developers were forced to remove WP GDPR Compliance from the official plugin catalog and only restored it a few days ago after the authors released the version 1.4.3, which fixed the problems.


However, Defiant experts warn that attacks are still ongoing. The fact is that many sites still work with plugin versions 1.4.2 and below, which means that they are still vulnerable.


A bug in WP GDPR Compliance allows attackers to access one of the plugin's internal functions and change the settings not only of the plugin itself, but of the entire CMS in general. There are currently two main attack scenarios. The first attack method looks like this:


  • intruder exploits a bug to open the site's registration system;
  • using a bug, it gives all new accounts the default administrator role;
  • the hacker registers a new account, which automatically receives administrator rights (as a rule, this account is called t2trollherten);
  • the attacker returns the default role for new accounts to the subscriber value and disables the registration of new users;
  • the hacker logs into a new administrative account;
  • a backdoor is installed on the site under the guise of wp-cache.php.

The backdoor contains a file manager, a terminal emulator and can run the PHP eval function, that is, it has everything necessary to upload additional payloads to the compromised site.

Second scenario The attacks, however, do not involve the creation of a new administrator account, which can be easily discovered by site owners. In this case, WP GDPR Compliance is used to add a new task to WP-Cron: download and install a 2MB Autocode plugin. With the help of this plugin, another backdoor is loaded onto the site (also disguised as wp-cache.php), slightly different from the one described above.

Although the second attack method was supposed to be more covert, it was Autocode that eventually drew users' attention to the problem, it was it that was initially considered the source of the problems, and it was thanks to this that Autocode was discovered gap in WP GDPR Compliance.


In their report, Defiant experts note that so far no malicious activity has been observed on sites hacked in such ways. Apparently, so far the attackers are simply accumulating hacked sites, increasing their number. These resources can then be used for SEO spam, malware or exploit kits, and other malicious activity.



Source: xaker.ru

Translate this article

TAGGED: Apple, Malware, PoC, Security, Split tunneling, WordPress
Tom Grant October 13, 2022 October 31, 2021
Share this Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

How to generate SSH keys on Windows 11
News 10 hours ago
How to enable file sharing on WSA for Windows 11
News 10 hours ago
Nine years of Project Galileo and how the last year has changed it
Nine years of Project Galileo and how the last year has changed it
Apps 17 hours ago
Dynamic data collection with Zaraz Worker Variables
Dynamic data collection with Zaraz Worker Variables
Apps 4 days ago
How to add CPU, GPU, RAM widgets on Windows 11
News 5 days ago

Recent Posts

  • How to generate SSH keys on Windows 11
  • How to enable file sharing on WSA for Windows 11
  • Nine years of Project Galileo and how the last year has changed it
  • Dynamic data collection with Zaraz Worker Variables
  • How to add CPU, GPU, RAM widgets on Windows 11

You Might Also Like

News

How to generate SSH keys on Windows 11

10 hours ago
Nine years of Project Galileo and how the last year has changed it
Apps

Nine years of Project Galileo and how the last year has changed it

17 hours ago
Dynamic data collection with Zaraz Worker Variables
Apps

Dynamic data collection with Zaraz Worker Variables

4 days ago
Reduce latency and increase cache hits with Regional Tiered Cache
Apps

Reduce latency and increase cache hits with Regional Tiered Cache

5 days ago
Show More

Related stories

How to Use Cloudflare to Secure Your WordPress Site
How To Starting Chrome from the command line
How to fix error 0x80070057 in Chrome?
Windows 10 How To Disable Slide to Shutdown
Windows search not working (FIX)
How to watch movies and TV series for free on Kinopoisk?
Previous Next

10 New Stories

Reduce latency and increase cache hits with Regional Tiered Cache
Cloudflare is deprecating Railgun
Triangulation: Trojan for iOS | Kaspersky official blog
Wordfence Intelligence Weekly WordPress Vulnerability Report (May 22, 2023 to May 28, 2023)
Safeguards against firmware signed with stolen MSI keys
WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
Previous Next
Hot News
How to generate SSH keys on Windows 11
How to enable file sharing on WSA for Windows 11
Nine years of Project Galileo and how the last year has changed it
Dynamic data collection with Zaraz Worker Variables
How to add CPU, GPU, RAM widgets on Windows 11
10alert.com10alert.com
Follow US

© 10 Alert Network. All Rights Reserved.

  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?