Several WordPress.org Plugins <= Various Versions - Injected Backdoor

Summary

Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.

Timeline

1. Jun 25, 2024, 3:30 AM UTCCVE published
2. Jul 3, 2024, 6:45 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Aug 1, 2024, 9:33 PM UTCRecord last updated

Affected versions

• warfareplugins Social Sharing Plugin – Social Warfare

  From 4.4.6.4 · through 4.4.7.1

• themerex Contact Form 7 Multi-Step Addon

  From 1.0.4 · through 1.0.5

• stuartobrien Simply Show Hooks

  From 1.2.1 · through 1.2.2

• pedrogusmao02 Wrapper Link Elementor

  From 1.0.2 · through 1.0.3

• blazeretail BLAZE Retail Widget

  From 2.2.5 · through 2.5.2

References 11