{"uuid": "1fe3adb9-6bd8-440d-84f4-b0fcb9d3c6c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-17233", "type": "seen", "source": "https://t.me/hacking_Attack/83088", "content": "Black Hat Ethical Hacking\nNew Linux malware uses 30 plugin exploits to backdoor WordPress sites\n\nNew Linux malware uses 30 plugin exploits to backdoor WordPress sitesPost Views: 8 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A previously unknown Linux malware has been exploiting\u00a030 vulnerabilities in multiple\u00a0outdated WordPress plugins and themes to\u00a0inject malicious JavaScript.According to a report by antivirus vendor Dr. Web, the malware targets both 32-bit and 64-bit Linux systems, giving its operator\u00a0remote command capabilities.\n\nThe main functionality of the trojan is to hack WordPress sites using a set of hardcoded exploits that are run\u00a0successively, until one of them works.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nThe targeted plugins and themes are the following:\n\n* WP Live Chat Support Plugin\n* WordPress \u2013 Yuzo Related Posts\n* Yellow Pencil Visual Theme Customizer Plugin\n* Easysmtp\n* WP GDPR Compliance Plugin\n* Newspaper Theme on WordPress Access Control (CVE-2016-10972)\n* Thim Core\n* Google Code Inserter\n* Total Donations Plugin\n* Post Custom Templates Lite\n* WP Quick Booking Manager\n* Faceboor Live Chat by Zotabox\n* Blog Designer WordPress Plugin\n* WordPress Ultimate FAQ (CVE-2019-17232 and CVE-2019-17233)\n* WP-Matomo Integration (WP-Piwik)\n* WordPress ND Shortcodes For Visual Composer\n* WP Live Chat\n* Coming Soon Page and Maintenance Mode\n* Hybrid\n\nIf the targeted website runs an outdated and vulnerable version of any of the above, the malware automatically fetches malicious JavaScript from its command and control (C2) server, and injects the script into the website site.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/website.png \n<figcaptionInjected redirection code (Dr. Web) \nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia\nTrending: Offensive Security Tool: OrbitalDump Infected pages act as redirectors to a location of the attacker\u2019s\u00a0choosing, so the scheme works best on abandoned sites.\n\nThese redirections may serve in phishing, malware distribution, and malvertising campaigns\u00a0to help evade detection and blocking. That said, the operators of the auto-injector might be selling their services to other cybercriminals.\n\nAn updated version of the payload that Dr. Web observed in the wild also targets the following WordPress add-ons:\n\n* Brizy WordPress Plugin\n* FV Flowplayer Video Player\n* WooCommerce\n* WordPress Coming Soon Page\n* WordPress theme OneTone\n* Simple Fields WordPress Plugin\n* WordPress Delucks SEO plugin\n* Poll, Survey, Form & Quiz Maker by OpinionStage\n* Social Metrics Tracker\n* WPeMatico RSS Feed Fetcher\n* Rich Reviews plugin\n\nThe new add-ons targeted by the new variant indicate\u00a0that the development of the backdoor is active at the moment.\n\nDr. Web also mentions that both variants contain functionality that is currently inactive, which would allow brute-forcing attacks against website administrator accounts.\n\nDefending against this threat requires admins of WordPress websites to update to the latest available version the themes and plugins running on the site and replace those that are no longer developed with alternatives that being supported.\n\nUsing strong\u00a0passwords and activating the two-factor authentication mechanism should ensure protection against brute-force attacks.\nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audienc[...]", "creation_timestamp": "2026-09-01T20:01:12.269274Z"}