{"id":32782,"date":"2023-01-12T09:54:25","date_gmt":"2023-01-12T09:54:25","guid":{"rendered":"https:\/\/www.digife.it\/?p=32782"},"modified":"2023-01-12T09:54:25","modified_gmt":"2023-01-12T09:54:25","slug":"30-wordpress-plugins-infected-with-malware-linux","status":"publish","type":"post","link":"https:\/\/www.digife.it\/en\/30-wordpress-plugins-infected-with-malware-linux\/","title":{"rendered":"30 WordPress plugins infected with Linux malware"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">There are 30 plugins and themes from <\/span><b>WordPress <\/b><span style=\"font-weight: 400;\">which have been labeled as vulnerable to a new Linux malware. Website owners need to take action, especially with out-of-date plugins and themes.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">hitherto unknown, <em>Linux.BackDoor.WordPressExploit.1<\/em> is a virus that affects 30 vulnerabilities of different themes and plugins <\/span><b>WordPress<\/b><span style=\"font-weight: 400;\">, with the purpose of introducing malicious Javascript into it.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">What are the risks for e-commerce and how to defend yourself?<\/span><\/p>\n<h3><b>WordPress under attack<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">&quot;<\/span><i><span style=\"font-weight: 400;\">The compromise of sites based on the popular CMS <\/span><\/i><b><i>WordPress <\/i><\/b><i><span style=\"font-weight: 400;\">it is a common activity in a wide range of illegal online activities, from phishing to distributing malware<\/span><\/i><span style=\"font-weight: 400;\">\u201d, explains Pierluigi Paganini, cyber security expert and CEO of the IT company <a href=\"https:\/\/www.cybhorus.com\/\" target=\"_blank\" rel=\"noopener\">Cybhorus<\/a>. Who adds: \u201c\u2026 <\/span><i><span style=\"font-weight: 400;\">in the campaign described by Dr. Web<\/span><\/i><span style=\"font-weight: 400;\"> (responsible for malware discovery),<\/span><i><span style=\"font-weight: 400;\"> malicious actors have targeted websites <\/span><\/i><b><i>WordPress <\/i><\/b><i><span style=\"font-weight: 400;\">using out-of-date plugins and themes and affected by known vulnerabilities that are easy to find an exploit in the criminal underground<\/span><\/i><span style=\"font-weight: 400;\">&quot;.\u00a0<\/span><\/p>\n<h3><b>Which themes and plugins are affected?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Specifically, the malware in question would affect Linux systems, both 32-bit and 64-bit ones, allowing attackers the possibility of remote command. The affected plugins and themes are:\u00a0<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP Live Chat Support Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press \u2013 Yuzo Related Posts<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Yellow Pencil Visual Theme Customizer Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">easy smtp<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP GDPR Compliance Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Newspaper Theme on Word Press Access Control (vulnerability CVE-2016-10972)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Thim Core<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Google Code Inserter<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Total Donations Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Post Custom Templates Lite<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP Quick Booking Manager<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Facebook Live Chat by Zotabox<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Blog Designer WordPress Plugins<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press Ultimate FAQ (vulnerabilities CVE-2019-17232 and CVE-2019-17233)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP-Matomo Integration (WP-Piwik)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press ND Shortcodes For Visual Composer<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP Live Chat<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Coming Soon Page and Maintenance Mode<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Hybrids<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The researchers also found a second version of the same malware: <em>Linux.BackDoor.WordPressExploit2<\/em>. It is an identical copy to the previous one, with the only difference being the C&amp;C server address. It can also affect a greater number of elements:\u00a0<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP Live Chat Support Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press \u2013 Yuzo Related Posts<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Yellow Pencil Visual Theme Customizer Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">easy smtp<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP GDPR Compliance Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Newspaper Theme on WordPress Access Control (CVE-2016-10972);<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Thim Core<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Google Code Inserter<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Total Donations Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Post Custom Templates Lite<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP Quick Booking Manager<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Facebook Live Chat by Zotabox<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Blog Designer Word Press Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press Ultimate FAQ (CVE-2019-17232 and CVE-2019-17233);<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP-Matomo Integration (WP-Piwik)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press ND Shortcodes For Visual Composer<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WP Live Chat<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Coming Soon Page and Maintenance Mode<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Hybrids<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Brizy WordPress Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">FV Flowplayer Video Player<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WooCommerce<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press Coming Soon Page<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press theme OneTone<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Simple Fields WordPress Plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Word Press Delights SEO plugin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Poll, Survey, Form &amp; Quiz Maker by OpinionStage<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Social Metrics Tracker<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">WPeMatico RSS Feed Fetcher<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Rich Reviews plugin<\/span><\/li>\n<\/ul>\n<h3><b>How does malware work inside WordPress?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Once you find the vulnerability within <\/span><b>WordPress<\/b><span style=\"font-weight: 400;\">, the malware inserts the malicious script, a trojan that infects some pages, which become a redirect to the attacker, giving him the possibility to control the pages remotely.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Explained through the words of Paganini: <\/span><i><span style=\"font-weight: 400;\">\u201conce the site was compromised <\/span><\/i><b><i>WordPress<\/i><\/b><i><span style=\"font-weight: 400;\">, the attackers inject Javascript scripts into some pages which cause that when a visitor clicks on any part of the page he is redirected to a site under their control and usable for different attack schemes (malware distribution, phishing, traffic redirection)<\/span><\/i><span style=\"font-weight: 400;\">&quot;.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Given the nature of the malware, the attack is more likely to succeed on sites that are abandoned or not regularly maintained, but the risks exist for everyone. So how to protect yourself?<\/span><\/p>\n<h3><b>How to protect yourself<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Ecommerce site managers need to learn how to protect themselves from potential attacks and this goes for all types of malware. For this reason it is essential to always keep all managed sites updated to the latest version available. Indeed, the continuous updates of plugins and themes make the task of hackers more difficult and, consequently, the site safer <\/span><b>WordPress<\/b><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Another simple precaution to implement is using strong passwords that are difficult to hack and using other security tools such as two-factor authentication.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Finally, our last advice is to rely, for the management of your e-commerce site, on a team of professionals who are always attentive to the latest news and problems. Like us at Digife! <a href=\"https:\/\/www.digife.it\/en\/contacts\/\">Contact us<\/a> for advice or to receive more information.<\/span><\/p>","protected":false},"excerpt":{"rendered":"<p>There are 30 WordPress plugins and themes that have been labeled as vulnerable to a new Linux malware. Website managers need to run for cover, especially\u2026<\/p>","protected":false},"author":35,"featured_media":32783,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-32782","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-curiosita-web"},"_links":{"self":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts\/32782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/comments?post=32782"}],"version-history":[{"count":1,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts\/32782\/revisions"}],"predecessor-version":[{"id":32784,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts\/32782\/revisions\/32784"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/media\/32783"}],"wp:attachment":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/media?parent=32782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/categories?post=32782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/tags?post=32782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}