Malware Exploiting Unpatched WordPress Plugin Vulnerabilities Hits Thousands of Sites

A recently discovered malware has infected hundreds, potentially thousands, of WordPress sites through unpatched vulnerabilities in 30 different plugins, according to security firm Dr.Web. The Linux-based malware installs a backdoor that redirects visitors to malicious sites and can disable event logging, go into standby mode, and shut itself down. It exploits vulnerabilities in plugins that add functionality to the core WordPress content management system, such as live chat or metrics reporting. More than 1,300 sites have been found to contain the JavaScript that powers the malware, though some may have removed it since the last scan. The malware, which has been in use for potentially three years, comes in two versions: Linux.BackDoor.WordPressExploit.1 and Linux.BackDoor.WordPressExploit.2. Criminals often use infected sites to redirect visitors to sites used for phishing, ad fraud, and distributing malware. WordPress site owners should ensure that they are using the most current versions of the main software and any plugins.

Below is a list of WordPress Plugins that have been exploited.