Dozens of WordPress plugins have been compromised by an unknown actor who planted backdoors in popular add-ons after buying them for hundreds of thousands of dollars.
WordPress developer and founder of Anchor Hosting, Austin Ginder, identified a supply chain attack affecting the popular content management system’s plug-ins.
Essential Plugins, a plugin maker with over 400,000 plugins, was bought, and backdoors were soon added to popular WordPress plugins.
WordPress has over 62,000 free plugins, which are used by millions of people who host their blogs or online media on the content management system.
Ginder found that more than 30 plugins had been purchased by a person named “Kris,” who claimed a background in SEO, online gambling, and cryptocurrency.
The user bought these unidentified plugins for six figures via the private marketplace Flippa.
While all seemed quiet, these plugins were harboring a dark secret that would come to light eight months later.
This investigation was started when WordPress announced that a plug-in called “Countdown Timer Ultimate” contained malicious code that could allow third parties to exploit it.
The notice prompted Ginder to take a look at more of Essential Plugin’s WordPress add-ons.
What Ginder found was that many of these WordPress plug-ins had been injected with sophisticated code that fetched spam links, redirects, and fake pages from a common-and control server, Ginder said.
The behavior of these compromised WordPress plug-ins wasn’t visible to users and was only visible to Googlebot.
This scheme was particularly sophisticated, as the bad actor’s domain was routed through an Ethereum smart contract.
The bad actor was capable of injecting plug-ins with malware that was only identifiable by Google, while also making it difficult for authorities to block the domain by using an Ethereum smart contract.
“Traditional domain takedowns would not work because the attacker could update the smart contract to point to a new domain at any time,” Ginder explained.
Earlier this month, WordPress’s Plugins Team officially closed every plugin from the company Essential Plugins.
This included at least 30 plugins, which Ginder fully lists in his blog post.
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked