WordPress plugins Are Vulnerable To Open Backdoors

Criminals no longer just use browser extensions to gain users’ trust and spread their malware. In this way, they currently gain access to a large number of websites. A significant portion of all offerings on the web are now made available through the WordPress content management system. Website operators can easily integrate various additional features into their projects using add-ons.

Attackers are increasingly using this to carry out so-called supply chain attacks – in other words, individual pages are no longer hacked, but malicious code is smuggled in through supposedly trustworthy third-party modules. Security researchers found a total of 93 different WordPress plugins and themes that were used to outfit a website with a backdoor that gave the attacker full administrative access.

These are extensions delivered through the AccessPress Themes platform, so it’s obvious that the attackers could access them, according to a report from Ars Technica appears. This is also supported by the fact that the same plugins and themes offered through other platforms like WordPress.org come without malicious code.

Verification Required

The backdoor code is injected into a file called initial.php, which is usually not part of the installation. This is then integrated via a manipulated variant of functions.php. The strange code itself is camouflaged with a base64 encoding so that it is not immediately noticeable on a superficial inspection. The security researchers themselves found several dozen sites in this way backdoors. However, the number can be much larger. In any case, WordPress administrators who have used the said download platform to obtain plugins should therefore check if the backdoor has been able to sneak in them.