Two vulnerabilities found in WordPress during November may have compromised thousands of websites. One security flaw involves a GDPR (General Data Protection Regulation) compliance plugin; the other involves a plugin used to create faster-loading pages.
In the latter case, the vulnerability allowed hackers to inject malicious HTML code into the homepage. There was no validation process to ensure that only site administrators could make changes to the main page, such as adding advertising banners.
The new version of the plugin has fixed this problem. However, websites still running the outdated version remain at risk of having their pages compromised by users without privileges, who can nevertheless inject malicious code or unwanted adverts, mining scripts and malware.
Security flaws compromised WordPress websites
The other serious security flaw was detected in a GDPR-related plugin and exploited by attackers to take control of vulnerable sites. The news was reported on the blog of Defiant, the developer of the Wordfence security plugin for WordPress.
Users of WordPress websites were advised to update to the latest plugin version, which fixed the problem, or remove the previous version.
Two methods of exploitation
Hackers apparently used two distinct methods to exploit the vulnerabilities. One involved changing user registration settings. The other involved injecting malicious actions that were scheduled and executed through WP-Cron.
One of the most common attempts to exploit this weakness appears to have been the arbitrary modification of settings on affected sites. By enabling new user registration and changing the default role to administrator, attackers could simply create privileged users, log in and do whatever they wanted on the compromised website.
Attackers exploited the vulnerabilities
There is another attack that is less visible and harder to spot at first glance: by injecting malicious actions into the site's WP-Cron, hackers could install a highly persistent backdoor that regenerated itself even after removal.
A wide variety of malicious actions were carried out this way, while others relied on another well-known WordPress plugin, WooCommerce.
What are the attacks trying to achieve?
Most infections involve one or more methods that benefit the attacker. Whether through sending spam, hosting a phishing scheme or another direct or indirect form of monetisation, a clear purpose can usually be identified during triage.
However, despite the rapid response in identifying these cases, so far only backdoor scripts have been found on sites affected by these attacks. No direct benefit to the hackers has been identified. This could mean several things: the attackers may have deliberately compromised websites in bulk to sell them to another hacker, or they may have their own purpose but have not yet moved to the second stage of the attack process.
In either case, infected sites should immediately work to identify and remove any threats.
Indicators of compromise
Below is a series of IOCs (Indicators of Compromise) that can be used to identify and triage cases similar to those discussed here. Remember that any established method can be changed by a hacker and used at any time, especially as more hackers begin exploiting these vulnerabilities.
Unauthorised accounts in the website's user database, including examples such as t2trollherten and t3trollherten
An entry in the website's options with an option_name beginning with 2mb_autocode (unless used intentionally)
The default_role option set to something other than "subscriber", unless intentional
The users_can_register option enabled unintentionally
Installed plugins
2MB Autocode (unless intentional)
New hacker attacks are expected in the near future
Conclusion
We hope the details shared here can be used to detect and prevent these attacks. However, the hacks can be modified and affect several different areas of a website.
Now that this vulnerability has been discovered and fixed, new, distinctive and sophisticated attack methods are expected to emerge soon. As always, keeping plugins up to date is essential to prevent situations like these from harming businesses or organisations.
