900,000 WordPress Websites Targeted In Large-Scale Attacks By One Hacker

WordPress is one of the most popular Content Management System (CMS) used by many web developers around the world to create websites.

And this time, a hacker has launched a massive-scale attack against more than 900,000 WordPress sites, seeking to redirect their visitors to malvertising sites through JavaScript, or plant a PHP backdoor if the administrator is logged.

The backdoor can then be used to plant another payload, and stores it inside the theme’s header in an attempt to execute it. “This method would allow the attacker to maintain control of the site”.

Based on the payload, the single threat actor used at least 24,000 IP‌ addresses over the past month to send malicious requests to the almost one million target websites.

According to a report from WordPress security company Defiant, the creator of Wordfence security plugin, attempts increased after April 28, and on its peak, made over 20 million attacks in May 3rd.

Ram Gall, senior QA at Defiant, said that the attackers focused mostly on exploiting cross-site scripting (XSS) vulnerabilities in plugins that were fixed months or years ago and had been targeted in other attacks.

900,000 WordPress websites were targeted

According to Gall, multiple vulnerabilities have been detected but the following are the most targeted:

  1. XSS vulnerability in the Easy2Map plugin, which was removed from the WordPress plugin repository in August of 2019. This accounted for more than half of all of the attacks.
  2. XSS vulnerability in Blog Designer which was patched in 2019. It's estimated that no more than 1,000 vulnerable installations remain.
  3. Options update vulnerability in WP GDPR Compliance patched in late 2018 which would allow attackers to change the site’s home URL in addition to other options. No more than 5,000 vulnerable installations remain.
  4. Options update vulnerability in Total Donations which would allow attackers to change the site’s home URL. An estimated less than 1,000 total installations remain.
  5. XSS vulnerability in the Newspaper theme which was patched in 2016. This vulnerability has also been targeted in the past.

Administrators of WordPress sites using those plugins are urged to update, or remove those that no longer in the WordPress repository.

The vast majority of these attacks are targeted at vulnerabilities that were patched months or years ago, and in plugins that don’t have a large number of users. While we did not see any attacks that would be effective against the latest versions of any currently available plugins, running a Web Application Firewall can also help protect your site against any vulnerabilities that might have not yet been patched. Most Cross-Site Scripting(XSS) attacks follow patterns that can be blocked regardless of the specific vulnerability being targeted."