Linux Malware Uses Plugin Exploits to Backdoor WordPress Sites

[Corrine]

From Bleeping Computer at New Linux malware uses 30 plugin exploits to backdoor WordPress sites:

A previously unknown Linux malware has been exploiting 30 vulnerabilities in multiple outdated WordPress plugins and themes to inject malicious JavaScript.

According to a report by antivirus vendor Dr. Web, the malware targets both 32-bit and 64-bit Linux systems, giving its operator remote command capabilities.

The main functionality of the trojan is to hack WordPress sites using a set of hardcoded exploits that are run successively, until one of them works.

The targeted plugins and themes are the following:

• WP Live Chat Support Plugin
• WordPress – Yuzo Related Posts
• Yellow Pencil Visual Theme Customizer Plugin
• Easysmtp
• WP GDPR Compliance Plugin
• Newspaper Theme on WordPress Access Control (CVE-2016-10972)
• Thim Core
• Google Code Inserter
• Total Donations Plugin
• Post Custom Templates Lite
• WP Quick Booking Manager
• Faceboor Live Chat by Zotabox
• Blog Designer WordPress Plugin
• WordPress Ultimate FAQ (CVE-2019-17232 and CVE-2019-17233)
• WP-Matomo Integration (WP-Piwik)
• WordPress ND Shortcodes For Visual Composer
• WP Live Chat
• Coming Soon Page and Maintenance Mode
• Hybrid

Additional information including more add-ons discovered by Dr. Web after further updates is in the referenced article.