Hackers exploit WordPress plugin flaw to infect 3,300 sites with malware

Hackers are breaching WordPress websites by exploiting a vulnerability in outdated variations of the Popup Builder plugin, infecting over 3,300 websites with malicious code.

The flaw leveraged throughout the assaults is tracked as CVE-2023-6000, a cross-site scripting (XSS) vulnerability impacting Popup Builder variations 4.2.3 and older, which was initially disclosed in November 2023.

A Balada Injector advertising marketing campaign uncovered initially of the yr exploited the precise vulnerability to infect over 6,700 websites, indicating that many web site admins hadn’t patched quickly ample.

Sucuri now evaluations recognizing a model new advertising marketing campaign with a notable uptick beforehand three weeks, concentrating on the similar vulnerability on the WordPress plugin.

In keeping with PublicWWW outcomes, code injections linked to this latest advertising marketing campaign are to be current in 3,329 WordPress websites, with Sucuri’s private scanners detecting 1,170 infections.

Injection particulars

The assaults infect the Customized JavaScript or Customized CSS sections of the WordPress admin interface, whereas the malicious code is saved all through the ‘wp_postmeta’ database desk.

The main function of the injected code is to behave as event handlers for various Popup Builder plugin events, harking back to ‘sgpb-ShouldOpen’, ‘sgpb-ShouldClose’, ‘sgpb-WillOpen’, ‘sgpbDidOpen’, ‘sgpbWillClose’, and ‘sgpb-DidClose.’

By doing that, malicious code executes at explicit actions of the plugin, like when a popup opens or closes.

Sucuri says the exact actions of the code may vary, nonetheless the most important goal of the injections appears to be redirecting friends of contaminated websites to malicious areas harking back to phishing pages and malware-dropping websites.

Particularly, in some infections, the analysts observed the code injecting a redirect URL (hxxp://ttincoming.traveltraffic[.]cc/?website guests) as a result of the ‘redirect-url’ parameter for a “contact-form-7” popup.

The injection above retrieves the malicious code snippet from an exterior provide and injects it into the webpage head for execution by the browser.

Virtually, it’s potential for the attackers to acquire a ramification of malicious targets by means of this system, many doubtlessly being additional excessive than redirections. 

Defending

The assaults originate from the domains “ttincoming.traveltraffic[.]cc” and “host.cloudsonicwave[.]com,” so blocking these two is actually helpful.

If you’re using the Popup Builder plugin in your web site, enhance to the newest mannequin, presently 4.2.7, which addresses CVE-2023-6000 and totally different questions of safety.

WordPress stats current that as a minimum 80,000 energetic websites presently use Popup Builder 4.1 and older, so the assault flooring stays vital.

Within the case of an an an infection, eradicating consists of deleting malicious entries from the Popup Builder’s personalized sections and scanning for hidden backdoors to forestall reinfection.