Since July 2019, over ten vulnerable WordPress plugins have been abused by hacker groups. By creating fake admin accounts, the hackers gain unauthorized access to backdoor sites.
The last two months have seen a rise in the number of hack attacks on WordPress sites. Attackers exploited the sites to inject malicious code into the victim’s site. The abuse of vulnerable plugins has affected the WordPress ecosystem.
When a visitor enters the hacked sites, this code is activated. Clicking on the displayed popup ads redirects visitors to malicious destinations. This includes scams and illegitimate sites for pharmaceuticals and pornography.
Hackers Can Now Fake Admin Accounts
Three weeks ago, ZDNet reported that the hacker group has changed its tactics. The modification on the malicious code planted on the victim’s site enabled the hackers to do more than just inserting pop-ups and redirects.
Hack-Attacks-WordPress-Plugins
The malicious code traced the login activity of the site owner. Once login was detected, the code grabbed the admin’s privileges to create a new admin account named wpservices with the email address [email protected].
By doing so, the hackers disguised their intention behind this account from the site’s owner. Not only would the hackers be able to exploit sites for monetary profits, but also for any activity they desire to execute with the site.
List of Vulnerable WordPress Plugins
- Blog Designer
- Bold Page Builder
- Coming Soon and Maintenance Mode
- Form Lightbox
- Hybrid Composer
- Live Chat with Facebook Messenger
- Visual CSS Style Editor
- WP Live Chat Support
- Yuzo Related Posts
- All former NicDark plugins (nd-booking, nd-travel, nd-learning, et. al.)
These plugins are discovered to be the older vulnerabilities, according to Mikey Veenstra.
Ways to Prevent Hack Attacks
1. Update Your Plugin Version
To prevent the hack attacks in question, site owners are advised to keep their plugins updated. This is because the older plugins version has higher security vulnerabilities.
As always, updating the plugins is a superb defense against hack attacks like these. High chances are your site ranking is going to be affected if your WordPress site is hacked. To gain your ranking back, consult our SEO experts today.
2. Clean Infected Sites
Also, WordPress site owners are urged to perform cleaning on infected sites. If done correctly, it would be workable to detect the backdoor systems the hackers might have left behind. Yet, this can be quite tricky and challenging.
Site owners are also advised to scan their websites with WordPress security plugins. Thus, getting professional help is crucial for non-technical users for the best result possible.
If you suspect your site to have experienced these hack attacks, iMarketing is here to help. Ring us up to learn more.
For more information, please go to SEO Malaysia or digital marketing.
