Filtered by category: WordFence, tag: malware × Clear
Inside a Malicious, Stealthy WordPress Must Use Plugin
Matched: WordPress
Wordfence researchers identified sophisticated WordPress malware installed as a must-use plugin, disguised as a health-check tool. It uses custom string obfuscation, hides itself from the dashboard, creates concealed administrator accounts, harvests plaintext passwords, and spreads to other WordPress installations on the same server. Its command channel uses EtherHiding, reading attacker server addresses from Ethereum smart contracts, making takedown difficult. The malware exfiltrates payment credentials, admin sessions, and WooCommerce data, and can remotely update itself, remove plugins, or inject JavaScript. Detection signatures were released June 23, 2026.
PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response
Matched: WordPress
A supply chain compromise was discovered in the BdThemes WordPress plugin ecosystem, reported to Wordfence on August 7, 2026. The attack involved a poisoned API response affecting multiple plugins from the vendor. All affected plugins have been temporarily closed in the official WordPress plugins directory while the WordPress Plugins team conducts a full inspection and ongoing investigation.