Skip to content
Sign in
Artwork for BMC Daily Cyber News
BMC Daily Cyber News · October 7 · 1 min

WordPress plugin attacks create hidden administrator access

Daily Cyber News: WordPress plugin attacks create hidden administrator access Attackers are exploiting flaws in two WordPress plugins to install backdoors and create hidden administrator access. Ninja Forms is installed on more than five hundred thousand sites, while WPC Product Bundles for WooCommerce is active on more than thirty thousand. The attack plants malicious JavaScript in a form submission or order. Key context: That cleanup warning matters because compromised sites can retain hidden accounts and secret login routes even after the visible malicious plugin is deleted. Additional detail: The larger lesson is that prevention and incident cleanup are separate jobs. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News. Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, WordPress, plugin, attacks, create, hidden, administrator, access.

0:00-1:25
Play in
Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

Daily Cyber News: WordPress plugin attacks create hidden administrator access

Attackers are exploiting flaws in two WordPress plugins to install backdoors and create hidden administrator access. Ninja Forms is installed on more than five hundred thousand sites, while WPC Product Bundles for WooCommerce is active on more than thirty thousand. The attack plants malicious JavaScript in a form submission or order.

Key context: That cleanup warning matters because compromised sites can retain hidden accounts and secret login routes even after the visible malicious plugin is deleted.

Additional detail: The larger lesson is that prevention and incident cleanup are separate jobs.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, WordPress, plugin, attacks, create, hidden, administrator, access.

more episodes

All episodes