Cybercriminals are exploiting security flaws in two WordPress plugins to compromise websites. The vulnerabilities affect Ninja Forms, used by over 500,000 sites, and WPC Product Bundles for WooCommerce, active on more than 30,000 sites. Both flaws are cross-site scripting vulnerabilities that require user authentication to exploit. Researchers at Patchstack discovered the campaign targeting WPC Product Bundles on October 4, followed by similar attacks against Ninja Forms the next day. The same malicious JavaScript code was used in both campaigns, suggesting a single threat actor.
Once activated, the malicious code installs a fake plugin and creates multiple administrator access points, including hidden accounts and secret login URLs designed to evade detection. Even if the malicious plugin is removed, hidden accounts and backup access mechanisms persist. Site administrators are urged to update to the latest plugin versions immediately. However, updating alone does not remove existing infections, so website owners should thoroughly check their sites for signs of compromise and investigate suspicious administrator accounts and access methods.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
