Massive attack against 1.6 million WordPress sites underway

[BassTrackerBoats]

Wordfence analysts report having detected a massive wave of attacks in the last couple of days, originating from 16,000 IPs and targeting over 1.6 million WordPress sites.

The threat actors target four WordPress plugins and fifteen Epsilon Framework themes, one of which has no available patch.

Some of the targeted plugins were patched all the way back in 2018, while others had their vulnerabilities addressed as recently as this week.

IP addresses launching the attacks
Source: Wordfence
The affected plugins and their versions are:

• PublishPress Capabilities
• Kiwi Social Plugin
• Pinterest Automatic
• WordPress Automatic

The targeted Epsilon Framework themes are:

• Shapely
• NewsMag
• Activello
• Illdy
• Allegiant
• Newspaper X
• Pixova Lite
• Brilliance
• MedZone Lite
• Regina Lite
• Transcend
• Affluent
• Bonkers
• Antreas
• NatureMag Lite – No patch available

Attack numbers spiking in the last couple of days
Source: Wordfence
"In most cases, the attackers are updating the users_can_register option to enabled and setting the default_role option to administrator," Wordfence explains.

"This makes it possible for attackers to register on any site as an administrator effectively taking over the site."

Check, update, clean​

To check if your site has already been compromised, you can review all user accounts and look for any rogue additions that should be removed immediately.

Next, review the site's settings at "http://examplesite[.]com/wp-admin/options-general.php" and pay attention to the Membership and the new user default role setting.

Checking settings on the site
Source: Wordfence
It is recommended to update your plugins and themes as soon as possible, even if they're not in the above list. If you're using NatureMag Lite, for which there's no fix, you should uninstall it immediately.

Note that updating the plugins won't eliminate the threat if your site has already been compromised. In this case, you are advised to follow the instructions found in detailed clean-up guides first.

In general, try to keep the number of plugins at your WordPress site to the absolute minimum necessary as this dramatically reduces the chances of being targeted and hacked in the first place.

Content source - https://www.bleepingcomputer.com/ne...c2UvPQm6p9z1MsuHsv0DP_mJ2JHfR8zH-I7umV6E7qmbg

 

[CreativeDaddy]

Thanks for the warning!

 

[BlueCatServices]

hope my competitors use wordpress

 

[BassTrackerBoats]

When you use themes and plugins that are not from the original source I am sure it is even worse.

Also, if you are using shared hosting and are hit odds are your other sites will be affected as well.

 

[Rollfic]

So in this case, are custom made themes that already has tons of plugins inbuilt are safe? Like for example Bimber theme?

 

[Gogol]

Stop using this shit guys. Switch to something custom, or atleast use a better alternative like reactjs and it’s derivatives.

 

[easybit]

I'm getting wordfence right now. ANyone else use it?

 

[BassTrackerBoats]

So in this case, are custom made themes that already has tons of plugins inbuilt are safe? Like for example Bimber theme?

I would not use them.

Plugins that are public plugins are notorious for being vulnerable.

Look, I'm not a techie, and that is common knowledge with anyone that knows me, but I stay away from things that are publically accessible when it comes to my sites as there are too many ways for Joe The Jackwagon to get involved in areas he should not be involved.

 

[Gogol]

ANyone else use it?

MANY, that’s why these vulnerabilities get used.

 

[Starblazer]

Webmasters should add it to a monthly schedule to update all themes & plugins (if they don't frequently update them). Outdated themes & plugins are a usual target for all such attacks.

 

[leechesBleechin]

it's been getting more and more nerve-wracking to use WordPress. Feels like no matter how many security precautions you take, and good practices you make, There's always something. I guess that's the nature of any internet technology but damn it's depressing. What might be arguably worse is you have to face the fact that there is scum scummy enough out there in the human race that jump on the opportunity as soon as it pops up. Soulless bitches.

 

[K-One]

Man, at this point I thought Automatic would at least implement something like a DSL to control with greater attention to security how the WP theme/plugin system works, but no it's still just a total PHP shitshow with seemingly almost always unfettered access to inject malicious script in some part of a codebase or other through a theme or plugin. Even Drupal has a far better security reputation. WP doesn't seem to have any security model at all.

 

[easybit]

MANY, that’s why these vulnerabilities get used.

What do you recommend for wordpress security?

 

[GenesisOne]

Never heard of those plugins or wp themes.
I am impressed that 1.6M sites use those.

 

[Gogol]

What do you recommend for wordpress security?

To be honest, I don't trust wordpress. Have stopped using it completely.

If I absolutely have to use it, I will make my own custom theme with page templates (the old fashioned way. It is not too tough to do so), and not use ANY plugin. Additionally, I would disable file execution inside wp-content/uploads folder. I would also turn off error reporting.

I could also use a different technology like nextJS for the frontend, while using wp as api, as an alternative strategy.

 

[ramuite]

Thank god. I have no Wordpress website running.

 

[The Economist]

So, are they brute-forcing the admin login, or what are they doing exactly, hacking wise?

 

[SEOMadHatter]

Sorry guys this was me, I needed some backlinks for a new project.

 

[towelfox]

This is why it's better to use a proper CMS. October CMS, Winter CMS are a couple of excellent Laravel based solutions - free caching plugins that won't get your site destroyed too

 

[Muskmallow]

Thanks for the warning!