A new Linux malware has been exploiting 30 vulnerabilities in outdated WordPress plugins and themes to deploy malicious JavaScripts.

Doctor Web researchers discovered a Linux malware, tracked as Linux.BackDoor.WordPressExploit.1, that compromises WordPress websites by exploiting 30 vulnerabilities in multiple outdated plugins and themes.

The malware injects into targeted webpages malicious JavaScripts, then when users click on the compromised page, they are redirected to other sites under the control of the attackers.

The malware targets both 32-bit and 64-bit versions of Linux, it supports backdoor capabilities and allows it to attack a specified webpage (website), switch to standby mode, shut itself down, and pause logging its actions.

Before attacking a website, the malware contacts the C&C server and receives the address of the site to infect. Then, the Linux.BackDoor.WordPressExploit.1 attempts to exploit vulnerabilities in the following plugins and themes if they are installed on target websites:

WP Live Chat Support Plugin

WordPress – Yuzo Related Posts

Yellow Pencil Visual Theme Customizer Plugin

Easysmtp

WP GDPR Compliance Plugin

Newspaper Theme on WordPress Access Control (vulnerability CVE-2016-10972)

Thim Core

Google Code Inserter

Total Donations Plugin

Post Custom Templates Lite

WP Quick Booking Manager

Faceboor Live Chat by Zotabox

Blog Designer WordPress Plugin

WordPress Ultimate FAQ (vulnerabilities CVE-2019-17232 and CVE-2019-17233)

WP-Matomo Integration (WP-Piwik)

WordPress ND Shortcodes For Visual Composer

WP Live Chat

Coming Soon Page and Maintenance Mode

Hybrid
“If one or more vulnerabilities are successfully exploited, the targeted page is injected with a malicious JavaScript that is downloaded from a remote server. With that, the injection is done in such a way that when the infected page is loaded, this JavaScript will be initiated first—regardless of the original contents of the page.” reads the advisory published by Dr. Web. “At this point, whenever users click anywhere on the infected page, they will be transferred to the website the attackers need users to go to.”

Visitors of compromised pages are redirected to malicious sites used to distribute malware and serve phishing pages. The researchers also spotted a more recent version of the malware that exploits vulnerabilities in the following WordPress plugins:

Brizy WordPress Plugin

FV Flowplayer Video Player

WooCommerce

WordPress Coming Soon Page

WordPress theme OneTone

Simple Fields WordPress Plugin

WordPress Delucks SEO plugin

Poll, Survey, Form & Quiz Maker by OpinionStage

Social Metrics Tracker

WPeMatico RSS Feed Fetcher

Rich Reviews plugin
The researchers noticed that both trojan variants contain unimplemented functionality for hacking the administrator accounts of WordPress websites through a brute-force attack using special dictionaries.

The researchers recommend admins of WordPress sites to keep all the components of the CMS up-to-date, and also urge to use strong and unique logins and passwords for their accounts.

The AV firm also shared Indicators of compromise for this threat.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, Lunix Malware)

The post New Linux malware targets WordPress sites by exploiting 30 bugs appeared first on Security Affairs.