Backdoor in 30 Wordpress Plugins

[gpietersz]

I know a lot of people here use Wordpress. You are probably not using any of the affected plugins but the wider issue is worth thinking about:

Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them.

There are a lot of supply chain attacks happening at the moment. A lot are indirect too (e.g. malware in tools developers use that inserts malware into their software) so very hard to guard against.

Minimise dependencies. For example, in the case of Wordpress and similar systems be careful what plugins you use.

 

[fisicx]

Use a security plugin like wordfence and changes to wp-config would have been blocked.

 

[gpietersz]

Use a security plugin like wordfence and changes to wp-config would have been blocked.

Yes, that would have (completely or not?) worked in this particular case, but supply chain attacks are going to work in a lot of different ways. I cannot find any references to Wordfence doing that after a quick scan of their documentation and would be interested to know how it works.

I prevent changes to config files and code files by simply not allowing them to be editable by the user the software runs as - but this may not work with some shared hosting.

There have also been cases where the malware has been injected by security related software: e.g. the Trivy vulnerability scanner. Not the same thing as a WP security plugin, of course, but illustrates the point that security is also a target. Whatever you do i think we need to be increasingly careful about dependencies. Maybe even more so with Wordpress where far more problems in general come from plugins than WP itself.

 

[YasmeenLondon]

Use a security plugin like wordfence and changes to wp-config would have been blocked.

Wordfence is good, I also recommend Patchstack, lighter than wordfence and has a huge and updated database of plugin vulnerabilities.

 

[gpietersz]

@YasmeenLondon Pathstack is a lot less well known though. If Wordfence was turned malicious anyone who keeps an eye on IT news would here about it. Patchstack is less well known so if it was bought and turned into malware would it be as well publicised, or spotted as fast?

Every plugin (including security ones) you add increases the risk, so you need to be selective.

This does not only happen with Wordpress plugins. its happened to a lot of browser extensions (especially Chrome ones) too. its happened to development tools. Supply chain attacks are a huge problem now. Looking at some of the biggest ones gives you a feel for the range of the attacks, but not for how common they are becoming: https://en.wikipedia.org/wiki/Supply_chain_attack#Examples

 

[YasmeenLondon]

@YasmeenLondon Pathstack is a lot less well known though. If Wordfence was turned malicious anyone who keeps an eye on IT news would here about it. Patchstack is less well known so if it was bought and turned into malware would it be as well publicised, or spotted as fast?

Respectfully I disagree. Patchstack is not really obscure inside the security world, in fact they're the largest CVE Numbering Authority for WordPress, coordinating over half of all known WP ecosystem vulnerabilities, a malicious update would get flagged VERY quickly.

 

[gpietersz]

Respectfully I disagree. Patchstack is not really obscure inside the security world,

You are probably right. They look like they are big enough not to be bought out by a scammer and professional enough to react quickly if there is an issue.

That said, however good a security plugin is, there is no complete solution for supply chain attacks - they are very hard to detect and mitigate befor damage is done.

 

[ThatDevAaron]

This is exactly the reason for major data breaches in the UK - fun fact, you have no ****ing clue how many credit cards and personal information is leaked from shitty wordpress sites.

It should be an industry standard, perhaps even regulation, that companies can't use Wordpress for customer data handling (personal info etc).

Honestly. Embarrassing.

 

[ThatDevAaron]

By the way - malicious updates are not the biggest concern, at all.

Poor code resulting in XSS, RCE, CSRF and other vital vulnerabilities, be even more overwhelming than a malicious update (btw in production its kinda crazy to have automatic updates for each plugin lmao you deserve the malicious update lmfao).

*people pay $100 to a 13 year old on a hacker forum for a really basic tool (similar to SQLMAP - something I wouldn't put past you being vulnerable too), they then scan random wordpress sites hoping one of them using a plugin or WP version that is indexed as vulnerable, boom, data is officially in the air like a fat spliff*

 

[gpietersz]

@ThatDevAaron I am pretty sure that you are blaming Wordpress too much. Most big breaches are not going to be Wordpress sites.


We do not need regulation. We need consequences for negligence in running systems that leads to breaches.

At the moment its not supply chain attacks (which are a much wider issue than malicious updates by a plugin developer) that are the most likely problem in the specific case of a Wordpress site, but its a very rapidly growing problem and affects all sorts of things, not just Wordpress. They have affected OSes, firmware, cloud hyperscalers and a lot more.

 

[fisicx]

This is exactly the reason for major data breaches in the UK - fun fact, you have no ****ing clue how many credit cards and personal information is leaked from shitty wordpress sites.

How many have been leaked from wordpress? Can't recall seeing any reports of this.

And major breaches are rarely if ever from WP sites.

 

[Nico Albrecht]

My take on it is fairly simple: WordPress getting hacked is hardly shocking.


The core problem, in my view, is that WordPress was never built with security as the first priority. It was built to be easy to use, easy to extend, and easy for anyone to throw up a website quickly. That is exactly why it became so popular, but it is also why it creates so many security headaches.


If you compare it to something like Drupal, the mindset is very different. Drupal was built with more of an enterprise, governance, and security-led approach from the start. I am not saying Drupal is perfect, because nothing is, but the foundations are very different. WordPress, by contrast, often feels like a system where convenience came first and security was expected to catch up later.


Then you add the plugin ecosystem into the mix, and that is where it starts to look a bit like the Wild West. You can install almost anything, from almost anyone, and hope it all behaves. From a security perspective, that is madness. Even the best security tools for WordPress can only do so much when the underlying model is basically: “let’s bolt on another plugin and see what happens.”


So when people say a WordPress site has been hacked, my reaction is usually: yes, that sounds about right. It is not because every WordPress site is doomed, but because the framework was never really designed from the ground up to be security-first. Once you build a system that way, trying to retrofit proper security years later, while carrying all the old legacy baggage, becomes extremely difficult.


I also think this will get worse before it gets better. With AI advancing so quickly, attackers will have better tools to scan code, spot weaknesses, automate exploitation, and scale attacks far faster than before. We are likely going to see more compromises, not fewer ( all types of attacks on different platforms ). On the other side, defenders are also using AI, so it is becoming a case of needing AI to protect yourself from AI.


To me, WordPress is a bit like the smartphone world. Mobile operating systems were not originally designed for the level of security we now expect from them. ( Mobile phone security on IOS and Android is piss poor done ) Over time, banking, identity, payments, and sensitive business functions all moved onto phones, and now the platforms are stuck trying to harden systems that were not originally designed for that level of trust. WordPress feels very similar. Security was not the original obsession, and once that ship has sailed, catching up later is messy, expensive, and never quite complete.


So yes, when a WordPress site gets hacked, it is unfortunate, but it is not surprising. In many ways, the platform was built for flexibility and growth first, and security has been playing catch-up ever since.

 

[ThatDevAaron]

How many have been leaked from wordpress? Can't recall seeing any reports of this.

And major breaches are rarely if ever from WP sites.

You aren't aware of what happens in the cyber security world. Ask anyone in the field. It's well known that there are automation tools that run against every known wordpress site in existence (its not hard to map every site using wordpress when tools like shodan.io make it that much easier, and yes, you're probably on this platform), trying to execute common exploits in older versions of WP, and commonly used plugins, alongside spamming SQL injection - these tools have a immensely high success rate on wordpress, compared to a bespoke platform.

I speak from experience, I don't need to prove myself, this isn't rocket science, ask chatgpt lmao

 

[ThatDevAaron]

Fun fact, its not just plugins that are vulnerable, it's themes too, the attack surface is just infinite wtf :C

 

[fisicx]

You aren't aware of what happens in the cyber security world. Ask anyone in the field. It's well known that there are automation tools that run against every known wordpress site in existence (its not hard to map every site using wordpress when tools like shodan.io make it that much easier, and yes, you're probably on this platform), trying to execute common exploits in older versions of WP, and commonly used plugins, alongside spamming SQL injection - these tools have a immensely high success rate on wordpress, compared to a bespoke platform.

I speak from experience, I don't need to prove myself, this isn't rocket science, ask chatgpt lmao

That didn’t answer my question. Obfuscation as normal.

 

[fisicx]

Fun fact, its not just plugins that are vulnerable, it's themes too, the attack surface is just infinite wtf :C

Misinformation. Some themes are vulnerable. Those hosted in the Wordpress repository are not.

 

[YasmeenLondon]

fun fact, you have no ****ing clue how many credit cards and personal information is leaked from shitty wordpress sites.

Honestly. Embarrassing.

Fun fact, you don't either, Wordpress e-commerce sites never store credit card details on the server, everything is sent to the payment gateway through an encrypted connection.

 

[gpietersz]

It's well known that there are automation tools that run against every known wordpress site in existence

I know this. I think most people participating here know this. ANyone who has looked at server logs knows this.

I speak from experience, I don't need to prove myself, this isn't rocket science, ask chatgpt lmao

ChatGPT is not a good source of evidence unless it provides citations. To be clear you are claiming to have personal experience of leaks of credit card numbers and other critical data from Wordpress sites?

I say this as someone who does not like Wordpress. it is a relatively insecure platform, but lots of people run Wordpress sites with no issues and have been doing so for years or even decades.

 

[fisicx]

@gpietersz - the evidence doesn’t exist because as @YasmeenLondon pointed out the card data is not stored locally so it can’t be exfiltrated from the Wordpress DB.

 

[gpietersz]

@fisicx I did not want to get into that for two reasons

1. there might be other ways of getting the card data (e.g. redirect to a fake gateway site) though a WP vulnerability
2. someone somewhere is bound to have decided to process cards with a system built on Wordpress.

I entirely agree that it is highly unusual for Wordpress based sites to store card data, but if @ThatDevAaron has evidence that shows otherwise I am all ears

@Nico Albrecht I think the biggest problem is that the architecture goes back to at least 2002. If you were starting from scratch now you would do things very differently. Unless it has changed since the last time I looked at it, Wordpress requires care on the part of the developer to do things such as protecting against SQL injection (i.e. escaping or parameterising use input in queries). If you built something now you would have some sort of DB layer (e.g. an ORM) to make it safer by default. The combination of requiring a fairly high level of competence from developers and the low barriers to doing it is a problem. Then again, the latter is why Wordpress has such a huge ecosystem.

 

[fisicx]

Wordpress now shuts down any plugin that isn’t sanitised, escaped and XSS compliant. They are now taking security seriously.

If you install a theme or plugin from outside the WP repositories you are far less protected.

 

[ctrlbrk]

If you install a theme or plugin from outside the WP repositories you are far less protected.

Just adding another angle to this: Wordpress founder Matt Mullenweg has an ongoing court case with WP Engine, one of the WP biggest service providers. This started back in 2024.

As part of this dispute Mullenweg, in a Trumpesque fashion, restricted access to the Wordpress repository to some members and forcefully amended some plugins.

The response from the community was that some of them did not feel they could rely anymore on WP repository and started hosting their plugins on their own sites.

 

[fisicx]

Themes are far worse, sites like envato host thousands of themes with little or no protection.

 

[ThatDevAaron]

Fun fact, you don't either, Wordpress e-commerce sites never store credit card details on the server, everything is sent to the payment gateway through an encrypted connection.

wrong.

yes, in most cases, payments are handled by the gateway, however, for a lot of WP sites, nearly, all passable billing information is given to the wordpress server and stored, including but not limited to, at times, direct debit details, perhaps PARTIAL card information (or this data is accessible via WP-admin - which in the event of a breach, is of course now in the hands of attackers, allowing them to know more specific information about your customers, making them easier targets).

 

[ThatDevAaron]

I know this. I think most people participating here know this. ANyone who has looked at server logs knows this.




ChatGPT is not a good source of evidence unless it provides citations. To be clear you are claiming to have personal experience of leaks of credit card numbers and other critical data from Wordpress sites?

I say this as someone who does not like Wordpress. it is a relatively insecure platform, but lots of people run Wordpress sites with no issues and have been doing so for years or even decades.

1. I was trolling, I never said chatgpt was a reliable source of info, just that I am not here to educate technological gorillas past what they want to know.

2. I've never had experience with anything wordpress, I don't use it. However, I know a lot of people that use it, and I have experience migrating people from wordpress, alongside solving system security problems due to bad wordpress setups.

now, I know for a fact, billing information is stored on WP/is obtainable via WP-admin via api calls at the very least - which allows for a full export of billing information.

The last 4 digits of someones card can be just as damaging as their entire 16 digit.

 

[fisicx]

… however, for a lot of WP sites, nearly, all passable billing information is given to the wordpress server and stored…

Can you give an example of a theme or plugin that does this? I’ve looked but not found anything in the WP repository that does so.

 

[ThatDevAaron]

@fisicx I did not want to get into that for two reasons

1. there might be other ways of getting the card data (e.g. redirect to a fake gateway site) though a WP vulnerability
2. someone somewhere is bound to have decided to process cards with a system built on Wordpress.

I entirely agree that it is highly unusual for Wordpress based sites to store card data, but if @ThatDevAaron has evidence that shows otherwise I am all ears

@Nico Albrecht I think the biggest problem is that the architecture goes back to at least 2002. If you were starting from scratch now you would do things very differently. Unless it has changed since the last time I looked at it, Wordpress requires care on the part of the developer to do things such as protecting against SQL injection (i.e. escaping or parameterising use input in queries). If you built something now you would have some sort of DB layer (e.g. an ORM) to make it safer by default. The combination of requiring a fairly high level of competence from developers and the low barriers to doing it is a problem. Then again, the latter is why Wordpress has such a huge ecosystem.

I don't need to provide evidence, due to the fact, that is true. Don't listen to fisicx - bro is trying his hardest to keep the platform he relies on for day-to-day development in the spotlight xD.

As you've stated:
2. someone somewhere is bound to have decided to process cards with a system built on Wordpress.
this is normal.
read what i posted above too:
> now, I know for a fact, billing information is stored on WP/is obtainable via WP-admin via api calls at the very least - which allows for a full export of billing information.

wordpress is for hobbyists, nothing else. If you use wordpress, I wish you the worst of luck (in a nice way).

 

[ThatDevAaron]

Wordpress now shuts down any plugin that isn’t sanitised, escaped and XSS compliant. They are now taking security seriously.

If you install a theme or plugin from outside the WP repositories you are far less protected.

KEYWORD:
They are now taking security seriously.
lol

stay away.

wordpress is garbage, wordpress developers are incapable. end of discussion thanx uwu

 

[ThatDevAaron]

Can you give an example of a theme or plugin that does this? I’ve looked but not found anything in the WP repository that does so.

I'll leave that to you kiddos who orient your entire career around drag and drops thanks..

this is all generic information, only uneducated people need EVIDENCE OF THIS. I'm not your tutor.

 

[ctrlbrk]

Can you give an example of a theme or plugin that does this? I’ve looked but not found anything in the WP repository that does so.

I seem to remember https://www.paidmembershipspro.com/ used to do this. I don't know if they still do.

 

[fisicx]

I seem to remember https://www.paidmembershipspro.com/ used to do this. I don't know if they still do.

There are a number of plugins like this - you take your chances on it being secure!

None of the plugins hosted by the WP repository save payment details - it's part of the vetting process when you apply to add you plugin to the repository (along with a long list of other requirements).

 

[Newchodge]

I'll leave that to you kiddos who orient your entire career around drag and drops thanks..

this is all generic information, only uneducated people need EVIDENCE OF THIS. I'm not your tutor.

Can I remind all contributors that you are expected to treat other forum members with respect and courtesy.

 

[YasmeenLondon]

I've never had experience with anything wordpress, I don't use it.

And yet you feel confident enough to talk about it like an expert.

I don't need to provide evidence, due to the fact, that is true.

I am sorry to be involved in this discussion, I should have known you are here to troll.

 

[gpietersz]

@fisicx vetting is not 100% effective. its slow and expensive and things can be missed. It also only helps with certain issues. It will catch a lot of SQL injection vulnerabilities (all though), but as these plugins show a lot of other things can get past.

The old fashioned nature of Wordpress might actually help. Plugins are self contained so you do not get the sort of issues the Node ecosystem is notorious for where installing one thing automatically installs huge numbers of dependencies.

I would really like to discuss supply chain attacks in general, not just Wordpress plugins. A wordpress install will be running on an OS, using library code, possibly with some sort of management UI, using a database, using various tools, all of which are possible targets.

@ctrlbrk Mullenweg's tantrums are a concern. They do not have a direct relevance to security, although they do undermine trust in the governance of Wordpress. Apart from his behaviour at a personal level, it has exposed a serious conflict of interests in his position in the non-profit Wordpress foundation and his company (which runs wordpress.com, among other things). Might be interesting to discuss that in another thread.

 

[ctrlbrk]

Mullenweg's tantrums are a concern.

Hence the Trumpesque adjective!

 

[gpietersz]

Hence the Trumpesque adjective!

and Matt is at it again: https://www.therepository.email/mat...t-akismet-on-wordpress-7-0s-connectors-screen

Huge conflicts of interest (this is not the first) caused by him running both the non-profit Foundation (wordpress.org) and the for-profit company (wordpress.com and other things)