WordPress Popup Builder Plugin Flaw Exploited by Hackers, Compromising 3,300 Sites

by | Mar 11, 2024 | News

Post Views: 355

Join our Patreon Channel and Gain access to 70+ Exclusive Walkthrough Videos.

Reading Time: 3 Minutes

Hackers are actively breaching WordPress sites by exploiting a vulnerability present in outdated versions of the Popup Builder plugin, resulting in the infection of over 3,300 websites with malicious code.

The vulnerability, known as CVE-2023-6000, constitutes a cross-site scripting (XSS) flaw affecting Popup Builder versions 4.2.3 and older. Initially disclosed in November 2023, this vulnerability has become a prime target for cybercriminals seeking to compromise WordPress sites.

Earlier this year, a Balada Injector campaign exploited this vulnerability, infecting over 6,700 websites. Despite this previous large-scale attack, Sucuri now reports a resurgence in attacks targeting the same vulnerability, with a significant uptick observed in the past three weeks.

See Also: So, you want to be a hacker?
Offensive Security, Bug Bounty Courses

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

According to findings from PublicWWW, malicious code injections associated with this latest campaign have been identified in 3,329 WordPress sites, with Sucuri’s own scanners detecting 1,170 infections.

Details

The attacks operate by infiltrating the Custom JavaScript or Custom CSS sections of the WordPress admin interface, storing malicious code within the ‘wp_postmeta’ database table. This injected code serves as event handlers for various Popup Builder plugin events, enabling malicious actions to occur, such as redirection to phishing pages and malware distribution sites.

One common method observed in these attacks involves injecting a redirect URL (hxxp://ttincoming.traveltraffic[.]cc/?traffic) as the ‘redirect-url’ parameter for a “contact-form-7” popup.

One variant of the injection (Sucuri)

The injection above retrieves the malicious code snippet from an external source and injects it into the webpage head for execution by the browser.

Mitigation

To defend against these attacks, it is crucial to block access to the domains “ttincoming.traveltraffic[.]cc” and “host.cloudsonicwave[.]com.” Additionally, website administrators are strongly advised to update the Popup Builder plugin to the latest version (currently 4.2.7), which addresses CVE-2023-6000 and other security vulnerabilities.

Despite the availability of patches, WordPress statistics indicate that a significant number of active sites continue to use older versions of the Popup Builder plugin. In the event of an infection, administrators must remove malicious entries from the plugin’s custom sections and conduct thorough scans to eliminate hidden backdoors and prevent reinfection.

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: bleepingcomputer.com

Source Link