Filtered by category: Infosecurity Magazine × Clear
PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Matched: WordPress
Attackers are exploiting a critical vulnerability in a third-party WooCommerce plugin to upload PHP webshells onto WordPress sites, gaining persistent backdoor access. The flaw allows unauthenticated file uploads, enabling remote code execution. Site owners are urged to update the affected plugin immediately and scan for indicators of compromise, including suspicious PHP files in upload directories.
WordPress Plugin Flaw Exposes 40,000 Sites to Admin Takeover
Matched: WordPress
A critical vulnerability in the WordPress User Profile Builder plugin, used by over 40,000 sites, allowed unauthenticated attackers to gain administrator-level access. The flaw enabled privilege escalation without requiring login credentials, potentially giving attackers full site control. A patch has been released and users are urged to update immediately.
WordPress Plugins Compromised Without a Single File Change
Matched: WordPress
Attackers backdoored WordPress sites by injecting malicious code into a third-party JSON feed consumed by plugins, rather than modifying plugin files directly. Because no plugin files were altered, standard file-integrity checks failed to detect the compromise. The attack highlights the risk of plugins that pull external data, as that data can serve as an infection vector bypassing conventional security monitoring.
Researchers Build WordPress Exploit Using OpenAI's GPT
Matched: WordPress
Researchers used OpenAI's GPT model to develop an exploit chain targeting a critical WordPress vulnerability. The work demonstrates AI's growing capability to assist in cybersecurity research, raising concerns about how the same tools could lower the barrier for malicious actors to develop working exploits from known vulnerabilities.