Fake WordPress security advisory pushes backdoor plugin
WordPress administrators are being emailed fake WordPress security advisories for a fictitious vulnerability tracked as CVE-2023-45124 to infect sites with a malicious plugin.
The campaign has been caught and reported by WordPress security experts at Wordfence and PatchStack, who published alerts on their sites to raise awareness.
Fake WordPress update
The emails pretend to be from WordPress, warning that a new critical remote code execution (RCE) flaw in the platform was detected on the admin’s site, urging them to download and install a plugin that allegedly addresses the security issue.
![Fake WordPress security advisory pushes backdoor plugin 2 Phishing email impersonating a WordPress security advisory](https://www.redpacketsecurity.com/wp-content/uploads/2023/12/phishing-email.png)
![Fake WordPress security advisory pushes backdoor plugin 2 Phishing email impersonating a WordPress security advisory](https://www.redpacketsecurity.com/wp-content/uploads/2023/12/phishing-email.png)
Source: PatchStack
Clicking on the email’s ‘Download Plugin’ button takes the victim to a fake landing page at ‘en-gb-wordpress[.]org’ that looks identical to the legitimate ‘wordpress.com’ site.
![Fake WordPress security advisory pushes backdoor plugin 3 Fake WordPress landing page](https://www.redpacketsecurity.com/wp-content/uploads/2023/12/landing-site.png)
![Fake WordPress security advisory pushes backdoor plugin 3 Fake WordPress landing page](https://www.redpacketsecurity.com/wp-content/uploads/2023/12/landing-site.png)
Source: PatchStack
The entry for the fake plugin shows a likely inflated download count of 500,000, along with multiple phony user reviews elaborating on how the patch restored their compromised site and helped them thwart hacker attacks.
The vast majority of the user reviews are five-star reviews, but four-, three-, and one-star reviews are thrown in to make it appear more realistic.
![Fake WordPress security advisory pushes backdoor plugin 4 Fake user reviews](https://www.bleepstatic.com/images/news/u/1220909/2023/Phishing/23/reviews.png)
Source: Wordfence
Upon installation, the plugin creates a hidden admin user named ‘wpsecuritypatch’ and sends information about the victim to the attackers’ command and control server (C2) at ‘wpgate[.]zip.’
Next, the plugin downloads a base64-encoded backdoor payload from the C2 and saves it as ‘wp-autoload.php’ in the website’s webroot.
The backdoor features file management capabilities, a SQL client, a PHP console, and a command line terminal and displays detailed information about the server environment to the attackers.
![Fake WordPress security advisory pushes backdoor plugin 5 Backdoor functionality](https://www.bleepstatic.com/images/news/u/1220909/2023/Phishing/23/backdoor-func.png)
Source: Wordfence
The malicious plugin hides itself from the list of installed plugins, so a manual search on the site’s root directory is required to remove it.
![Fake WordPress security advisory pushes backdoor plugin 6 Code to hide the admin user and the malicious plugin](https://www.bleepstatic.com/images/news/u/1220909/2023/Phishing/23/hide.png)
Source: PatchStack
At this time, the operational goal of the plugin remains unknown.
However, PatchStack speculates that it might be used for injecting ads on compromised sites, performing visitor redirection, stealing sensitive information, or even blackmailing owners by threatening to leak their website’s database contents.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.