Hidden Backdoor Constitute Inwards Wordpress Captcha Plugin Affects Over 300,000 Sites

Buying pop plugins alongside a large user-base too using it for effortless malicious campaigns convey give-up the ghost a novel tendency for bad actors.

One such incident happened of late when the renowned developer BestWebSoft sold a pop Captcha WordPress plugin to an undisclosed buyer, who thence modified the plugin to download too install a hidden backdoor.

In a acquire pop plugins too applications to stealthy infect their large user base of operations alongside malware, adware, too spyware.

While figuring out the actual identity of the Captcha plugin buyer, WordFence researchers constitute that the simplywordpress[dot]net domain serving the backdoor file was registered to mortal named "Stacy Wellington" using the electronic mail address "scwellington[at]hotmail.co.uk."

Using opposite whois lookup, the researchers constitute a large issue of other domains registered to the same user, including Convert me Popup, Death To Comments, Human Captcha, Smart Recaptcha, too Social Exchange.

What's interesting? All of the above-mentioned domains booked nether the user contained the same backdoor code that the WordFence researchers constitute inward Captcha.

WordFence has teamed upwards alongside WordPress to piece the affected version of Captcha plug-in too blocked the writer from publishing updates, thence websites administrators are highly recommended to supervene upon their plugin alongside the latest official Captcha version 4.4.5.

WordFence has promised to unloose in-depth technical details on how the backdoor installation too execution works, along alongside a proof-of-concept exploit subsequently thirty days thence that admins instruct plenty fourth dimension to piece their websites.

Share This :