How serious are the WordPress Malware Attacks?
According to the WordCamp site, there are currently over 75 million sites that use WordPress. While no one actually has the actual number of attacks. The WordFence plugin has been downloaded over 180 million times and protects 4 million WordPress websites.
WordFence reported their customers experience 2800 malicious login attempts per second. WordFence analysis accounts for a very small portion of the WordPress user base.
If malicious attacks rates are consistent. The WordPress platform could easily have 50,000 attacks per-second.
The likelihood of the attacks being consistent is slim. Hackers are smart people. They know that attacking a WordPress site without Security is easier to access than one with Security. Attacks on systems without security is more prevalent.
2021 WordPress Hacks
Shared Hosting Vulnerability
FINALLY – Sucuri has reported (what I have been telling my clients for years). Shared Hosting requires that all sites are up-to-date. Hackers are able to access a website via the cPanel by first accessing a known vulnerable site on the cPanel hosting.
For more information on Share Hosting Infections read – Trojan Spyware and Bec Attacks (if you are not techinal jump to the article conclusion).
Keep All Sites Current to Avoid Shared Hosting Hack.
2021 WordPress Plugin Attacks
Two critical severity flaws in Facebook for WordPress (formerly Facebook Pixel). The first flaw allowed hackers to achieve remote code execution.
The second flaw simply had to trick the admin user to click a link and the hackers could inject malicious code into the site.
The full scale of attack remains undetermined. By injecting Scripts hackers can skim credit card info. And, redirect users to fake sites.
Users were redirected to fake sites. And, prompted to confirm they were not a robot. As of March 2021, the malicious file is undetected by 90% of antivirus engines.
Compromise the admin accounts. Then using the site to install malicious plugin wpstaff.
Inject malicious code into vulnerable website. And take over the website.
Attackers send out newsletter with their own custom content. Followed by deleting your entire contact list. Let Mailchimp handle your newsletter services.
Sucuri reported the 123ContactForms hack. Attackers are able to use software flaws to create their own posts. And, easily add malicious files to the website.
Stored cross-site scripting (xss) security bug.
Ninja Forms Plugin
Critical security Flaws January 2021 & June 2020.
- 📰 ninjaforms (1+ million installs)
BUG 1: Authenticated Email Hijacking Account Takeover.
Attacker with subscriber-level access (the lowest access available to WordPress users).
Bug 2: Authenticated OAuth Connection Key Disclosure.
Low-level users able to trigger and retrieve client_id for established OAuth connections.
Bug 3: Cross-Site Request Forgery to OAuth Service Disconnection.
Attackers could disconnect OAuth connections. Establish a connection with the Ninja Form dashboard – and read mail.
Bug 4: Administrator Open Redirect.
Attacker redirects the admin user to malicious site. And, infecting the admin’s computer with malware.
2020 WordPress Plugin Attacks
Hackers were able to identify admin users. Followed by a password reset. Locking the admin user out. And, giving the hacker full control to all site functions and user accounts.
WordPress developers categorized the security issues affecting the plugin and one-of-the-worst.
WordPress developers pushed an automatic update to all users (even those that had the plugin disabled).
The forced update was the first indicator that WordPress has the ability to automatically update everyone’s plugins – even when they are not active.
NextGEN Gallery Plugin
Here are articles to learn more about the NextGen Plugin hack.
Over 530,000 sites are still exposed to attackers. Yes, NextGen Gallery got hit by another hacker. This time, using Remote Code Execution to effectively take over the WordPress site.
NextGEN Gallery acted quickly to provide a patch for the hack. A few days after the release only a small portion of the GalleryGen Gallery plugin had updated to the safe version of the plugin. Leaving more than 530,000 potentially exposed to takeover attacks.
In 2017, NextGen Gallery was attacked with a SQL injection. Allowing hackers access to the website database. Including sensitive user information.
Threat Intelligence team reported a XSS flaw in Ninja Forms. The plugin flaw let attackers replace contact forms with a malicious form.
Learn More About WordPress
Read my most recent WordPress Blogs.
Minutes - Sandy Mush WordPress Meeting #005 Tuesday, 26th January...
WordPress and Progressive Web Apps (PWA) Progressive Web Apps...
What is the Impact of WordPress Plugins What is the real impact of...
Read my blog to learn more about The Impact of Using WordPress Plugins
- 2/18/21 – Added second NextGEN Gallery WordPress plugin article link.
- 2/25/21 – Added second Ninja Forms WordPress Plugin hacked.
- 3/3/21 – Updated Ninja Forms Bug 3.
- 3/16/21 – Page Layout Redesign. More information at the bottom of page.
- 3/16/21 – Added new listing. Contact Form 7, Elementor, Popup Builder, and Orbit Fox.
- 4/8/21 – Added jQuery Migrate plugin.