If you are a WordPress site admin, be wary of incoming emails – one could be a phishing message looking to infect your site with malicious plugins.

This is the warning given out by WordPress security experts Wordfence and PatchStack, which have found WordPress site admins receiving emails impersonating the legitimate wordpress.com site. 

In the emails, the admins were warned of a new (but actually bogus) remote code execution (RCE) flaw and were urged to immediately install a plugin to defend their site from hackers. The non-existent flaw is tracked as CVE-2023-45124, the fraudsters claim.

Injecting WordPress sites with ads

Gullible admins that click the “Download Plugin” button are then redirected to a fake landing page where they can review, and download, the “plugin”. The reviews are a mix of five-star, four-star, and even one-star ratings, to add legitimacy to the whole ordeal. The site also claims the plugin has had more than 500,000 downloads, and comes with reviews that are a mix of praise and critique.

The plugin does a number of malicious things to the infected WordPress instance. Firstly, it creates a hidden admin user, giving the attacker administrative privileges, but also exfiltrates important information about the website to the plugin’s operators, and downloads a backdoor that comes with file management features, an SQL client, a PHP console, and more. Finally, it tries to remain hidden and out of sight, which means admins need to manually search on the site’s root directory for it, in order to find and remove the malware

While the malicious plugin’s end goal is still unclear at this time, researchers speculate that it could be used to inject unwanted ads on the compromised website. In some scenarios, plugins such as this one were used to redirect visitors to different sites, steal sensitive data, and more.

Via BleepingComputer

More from TechRadar Pro

Go to Source

Follow us on FacebookTwitter and InstagramWe are growing. Join our 6,000+ followers and us.

At TechRookies.com will strive to help turn Tech Rookies into Pros!

Want more articles click Here!

Deals on Homepage!

M1 Finance is a highly recommended brokerage start investing today here!

WeBull. LIMITED TIME OFFER: Get 3 free stocks valued up to $6300 by opening & funding a #Webull brokerage account! “>Get started >Thanks for visiting!

Subscribe to our newsletters. Here! On the homepage

Tech Rookies Music Here!

Disclaimer: I get commissions for purchases made through links in this post at no charge to you and thanks for supporting Tech Rookies.

Disclosure: Links contain affiliates. When you buy through one of our links we will receive a commission. This is at no cost to you. Thank you for supporting Teachrookies.com

Disclaimer: This article is for information purposes and should not be considered professional investment advice. It contains some forward-looking statements that should not be taken as indicators of future performance. Every investor has a different risk profile and goals. All investments have risks. Always do your own research or hire an expert before investing and trading.