Doctor Web researchers discovered a Linux malware, tracked as Linux.BackDoor.WordPressExploit.1, that compromises WordPress websites by exploiting 30 vulnerabilities in multiple outdated plugins and themes.
The malware targets both 32-bit and 64-bit versions of Linux, it supports backdoor capabilities and allows it to attack a specified webpage (website), switch to standby mode, shut itself down, and pause logging its actions.
Before attacking a website, the malware contacts the C&C server and receives the address of the site to infect. Then, the Linux.BackDoor.WordPressExploit.1 attempts to exploit vulnerabilities in the following plugins and themes if they are installed on target websites:
WP Live Chat Support Plugin
WordPress – Yuzo Related Posts
Yellow Pencil Visual Theme Customizer Plugin
WP GDPR Compliance Plugin
Newspaper Theme on WordPress Access Control (vulnerability CVE-2016-10972)
Google Code Inserter
Total Donations Plugin
Post Custom Templates Lite
WP Quick Booking Manager
Faceboor Live Chat by Zotabox
Blog Designer WordPress Plugin
WordPress Ultimate FAQ (vulnerabilities CVE-2019-17232 and CVE-2019-17233)
WP-Matomo Integration (WP-Piwik)
WordPress ND Shortcodes For Visual Composer
WP Live Chat
Coming Soon Page and Maintenance Mode
Visitors of compromised pages are redirected to malicious sites used to distribute malware and serve phishing pages. The researchers also spotted a more recent version of the malware that exploits vulnerabilities in the following WordPress plugins:
Brizy WordPress Plugin
FV Flowplayer Video Player
WordPress Coming Soon Page
WordPress theme OneTone
Simple Fields WordPress Plugin
WordPress Delucks SEO plugin
Poll, Survey, Form & Quiz Maker by OpinionStage
Social Metrics Tracker
WPeMatico RSS Feed Fetcher
Rich Reviews plugin
The researchers noticed that both trojan variants contain unimplemented functionality for hacking the administrator accounts of WordPress websites through a brute-force attack using special dictionaries.
The researchers recommend admins of WordPress sites to keep all the components of the CMS up-to-date, and also urge to use strong and unique logins and passwords for their accounts.
The AV firm also shared Indicators of compromise for this threat.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Lunix Malware)
The post New Linux malware targets WordPress sites by exploiting 30 bugs appeared first on Security Affairs.
Source: Read More