Dozens of plug-ins for the widely used open source web blogging software WordPress are now offline after a backdoor was discovered in them, used to push malicious code to any website that relied on the plug-ins. The backdoor was discovered after a new corporate owner bought these plug-ins.
Anchor Hosting founder Austin Ginder sounded the alarm in a blog post last week describing a supply chain attack on a WordPress plug-in maker called Essential Plugin. Ginder said someone last year bought Essential Plugin and the backdoor was soon added to the plug-ins’ source code. The backdoor sat dormant until earlier this month when it activated and began distributing malicious code to any website with the plug-ins installed.
Essential Plugin says on its website that it has over 400,000 plug-in installs and more than 15,000 customers. WordPress’ plug-in install page says the affected plug-ins are in over 20,000 active WordPress installations.
Plug-ins allow owners of WordPress-based websites to extend the site’s functionality, but in doing so grant the plug-ins access to their installations, which can open these websites to malicious extensions and potential compromise. But Ginder warned that WordPress users are not notified of any plug-ins’ change in ownership, exposing users to potential takeover attacks by their new owners.
According to Ginder, this is the second hijack of a WordPress plug-in discovered in as many weeks. Security researchers have long warned of the risks of malicious actors buying software and changing its code in order to compromise a large number of computers around the world.
While the plug-ins have been removed from WordPress’ directory and now list their closure as “permanent,” Ginder warned that WordPress owners should check if they still have one of the malicious plug-ins installed and remove it. Ginder has a list of the affected plug-ins in the blog post.
Representatives for Essential Plugin did not respond to a request for comment.
[ad_2]
Source link
More on someone planted backdoors in dozens
Stay tuned for updates on someone planted backdoors in dozens as the story develops. Related: Mobile & Accessories.
Frequently Asked Questions
Dozens of WordPress plug-ins were taken offline after a backdoor was discovered in plug-ins from Essential Plugin, which has over 400,000 installs; the backdoor was added after a new corporate owner bought the plug-ins and sat dormant before activating to push malicious code.
Anchor Hosting founder Austin Ginder sounded the alarm in a blog post describing the supply chain attack, warning that WordPress users are not notified of plug-in ownership changes, exposing them to takeover attacks by new owners.
The affected plug-ins are in over 20,000 active WordPress installations according to WordPress' plug-in page, and the plug-ins were removed from the directory with their closure listed as permanent.
WordPress owners should check if they still have one of the malicious plug-ins installed and remove it; Ginder has a list of the affected plug-ins in his blog post.
