Threat Update
AccessPress, a popular WordPress theme and plugin provider, was compromised in early September 2021 and several of their themes and plugins were injected with a backdoor. This gave the attackers full access to websites that installed these plugins. While the plugins and themes available on the vendor’s website were infected, the same plugins and themes available on WordPress directory were not infected. FinGarde recommends replacing/updating WordPress if you believe you have used any of these themes or plugins, and hunting for certain file changes detailed in our full recommendations below.
Technical Detail & Additional Information
WHAT IS THE THREAT?
AccessPress, a popular WordPress theme and plugin provider, was compromised in early September of 2021 and several of their themes and plugins were injected with a backdoor. A backdoor is a method which allows unauthorized remote access to a system or application. Backdoors can be installed by hackers, IT professionals, governments, etc. and are typically used for spying, data theft, cryptojacking, infecting websites or to install other malware. Common examples of backdoors include Trojans, rootkits, hardware backdoors and cryptographic backdoors. A backdoor can be installed in the target software, or it can be embedded in the hardware making it more difficult for traditional anti-virus/anti-malware tools to identify it. The attack on AccessPress also qualifies as a supply chain attack, wherein an attacker gains access to an organizations’ network/services by attacking the vendor or services provided by a vendor that are used by that organization.
WHY IS IT NOTEWORTHY?
Attacking a vendor’s website and then injecting its’ products with a backdoor qualifies this as a supply chain attack. WordPress themes are widely used to make websites graphically more presentable, and WordPress plugins are small software additions which run on top of existing WordPress software. Every organization downloading these plugins will become infected and are at risk of becoming compromised if proper security practices are not in place.
WHAT IS THE EXPOSURE OR RISK?
The attackers have injected the extensions with a dropper for a webshell that gives the attacker complete access to the infected sites. The attackers are suspected of selling the access to infected websites to other cybercriminals, as some of the infected websites were observed to be carrying a spam payload. The spam payloads in question were most commonly used to redirect the users to other malicious websites. The websites using these plugins or themes are at the risk of becoming compromised and fully exposed to the attackers, leading to loss of data and public reputation.
WHAT ARE THE RECOMMENDATIONS?
FinGarde recommends the following actions to limit the impact of a backdoor attack:
- Replace the infected plugins or themes with the latest versions available from WordPress repository.
- Install a clean version of WordPress to remove any modifications done by the attackers.
- Perform thorough review of the website code to identify any other potentially malicious code.
- To identify if the website is infected or not, check the “wp-includes/vars.php” file around line 146-185 for “wp_is_mobile_fix” function with some obfuscated code.
- Query file systems for “wp_is_mobile_fix” or “wp-theme-connect” to identify infected files.
- Change all the admin, user and database passwords.
- Follow incident response process to identify and remove any post-exploitation activities.
REFERENCES
For more in-depth information about the recommendations, please visit the following links:
- https://www.techzine.eu/news/security/71710/wordpress-plugins-from-accesspress-themes-have-backdoors-for-hackers/
- https://securityaffairs.co/wordpress/127124/hacking/tens-of-accesspress-wordpress-themes-compromised-as-part-of-a-supply-chain-attack.html
- https://www.thesecmaster.com/how-to-detect-and-fix-cve-2021-24867-backdoor-in-accesspress-themes-and-plugins/
- https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/
- https://thehackernews.com/2022/01/hackers-planted-secret-backdoor-in.html
If you have any questions, please contact us.
Your point of view caught my eye and was very interesting. Thanks. I have a question for you.
Gadonthomobet is a good place to get started with online betting, in my opinion. Worth a visit: gadonthomobet
Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?
Yo, looking for a solid agent? Agent Bong88 seems like a good place to start. Check ’em out for yourself! agent bong88
Interesting analysis! Seeing platforms like 789wim legit focus on data-driven personalization is a smart move. It’s not just about luck, but enhancing the user experience – a new approach to Vietnam’s gaming scene! 🤔
Can you be more specific about the content of your article? After reading it, I still have some doubts. Hope you can help me.
Can you be more specific about the content of your article? After reading it, I still have some doubts. Hope you can help me.
Thanks for sharing. I read many of your blog posts, cool, your blog is very good.
Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me? https://www.binance.com/fr/register?ref=T7KCZASX
Yo, I tried out qq8889 and it was an okay experience. The site could use a little work, but the games are decent. If are looking to try something new, try this!
Alright, checked out 556betcom. Looks decent. Clean interface, easy to understand the odds. If you like straightforward betting, this isn’t a bad option. Take a peek: 556betcom
615bet18, not heard tons about them but worth a look. Maybe they have something unique to offer. Why not give it a quick glance and see if anything jumps out? Check them out: 615bet18
Hey, tried ku66bet.info. Really loved the interface. I liked the sportsbetting options. The experience was engaging. Check this out now! ku66bet
Mh888… hmm. It’s alright. Nothing really jumps out at me, but nothing particularly bad either. Just kind of…average. Check it out and decide for yourself: mh888
Checking out 58wim.info. Seems promising so far. Going to explore the different options. Anyone else had any luck? Check it out: 58wim
Yo, I use p898login for super easy access to P898, it saves a lot of time. go check it out! quick access: p898login
Yo, check out fi777! Heard some good things, might be a decent spot to try your luck. Anyone else had any good experiences? Let me know!
Been hearing buzz about 188jl. What’s the honest opinion? Good odds? Easy payouts? Don’t hold back!
Yo, 115slotgame is cool! A lot of fun slot variety, and the graphics are vibrant. I recommend you try it: 115slotgame
Aight, 7f777 is what it is. Nothing too crazy, but a solid place to kill some time. If you’re bored, check it out. 7f777
Yo, been messing around with cb777 and it’s legit! Plenty of games to keep you occupied. Worth checking out, for real. Link in bio: cb777
Yo, bjbajilogin lookin’ kinda fresh. The site’s clean and easy to navigate. Definitely worth a look if you’re lookin’ for somethin’ new: bjbajilogin
Hey, gotta say I’m really digging pak33game1 lately. The games are pretty decent and it’s been a fun way to kill some time. Check it out for yourself at pak33game1!
Winforlife88… that name caught my eye! My experience has been alright, not a massive score, but some fun times. Needs a bit more polish on the mobile version I reckon. Explore it here: winforlife88
Thanks for sharing. I read many of your blog posts, cool, your blog is very good.
Adda 52 is my go-to for online poker action. Hoping to crush some tables tonight! See you there! Find it here: adda 52
Checking out Betmadrid to place some bets on the upcoming games. Hoping for a good payout! See for yourself here: betmadrid
Looking for the Diuwin download APK. Has anyone tried it? Need to find a new game to play! Check this: diuwindownloadapk
Yo, checking out 868vip1. The site looks legit, and they have a decent selection of games. I haven’t won big yet, but I also haven’t been burned. Worth a look if you’re seeking a new place to try your luck: 868vip1.
Easiest login ever. 166Betlogin straight to the point, no messing about. Gets you playing quick. The easiest access can be found through 166betlogin.
Alright, 9betapp in the house! The UI looks clean and user-friendly. I saw some things I liked. Come and visit 9betapp
Your article helped me a lot, is there any more related content? Thanks!
Sup! I’m checking 666d.info. Just found this 666d, is anyone playing it? 666d
BigWinCasino… hmm, interesting name, right? Well, the game variety is pretty standard, but the graphics are sharp and the site’s easy to navigate. Still early days for me, but I’m seeing potential. Give it a look here bigwincasino.
Heard about jj804game and finally checked it out. Pretty solid games, not gonna lie. Been grinding for a bit and having a good time. Check it out, might be your next go-to! jj804game
Mana88 club, eh? Sounds exclusive. Wonder if it lives up to the hype. Time to investigate this Mana88 club: mana88.club
Checking out the Pagcor Portal. Gotta make sure everything’s on the up and up, you know? Responsibility is key! See you there: pagcor portal
Yo, PH333PHCasino is my go-to spot! Always a good time and the games are fire. Check it out ph333phcasino.
Reading your article helped me a lot and I agree with you. But I still have some doubts, can you clarify for me? I’ll keep an eye out for your answers. https://www.binance.com/register?ref=IHJUI7TF
Your article helped me a lot, is there any more related content? Thanks! https://accounts.binance.info/sl/register-person?ref=I3OM7SCZ
Oi, keen on joining FB88? 88bettop1.com is where it’s at for registration, apparently. Get yourself signed up here: đăng ký fb88 88bettop1.com. Give it a go!
Heard Jili Money Coming is hot right now. Giving it a try, feels lucky! Give it a shot here: jili money coming
Thinking about going VIP on new88.com. Is it worth the upgrade? Possibly via this link?: new88.com vip
Looking into the app live 789 option. Hoping the download process is straightforward and that the app is stable. Hate it when a platform crashes mid-game A app live 789
Anyone know if 92lottery com is legit? Want to try my luck there! Let me know your thoughts. Check it out here: 92lottery com
slot.vip casino has a decent selection of games that keep me coming back for more. The odds seem fair enough too. Give it a shot! slot.vip casino
Reading your article helped me a lot and I agree with you. But I still have some doubts, can you clarify for me? I’ll keep an eye out for your answers.
Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?
Thanks for sharing. I read many of your blog posts, cool, your blog is very good. https://accounts.binance.info/en-IN/register-person?ref=A80YTPZ1
Thanks for sharing. I read many of your blog posts, cool, your blog is very good. https://accounts.binance.info/ru/register?ref=O9XES6KU
F1685 is my go-to lately. Quick payouts and a solid platform. If you’re looking for something new, give it a shot! Seriously, what are you waiting for? f1685
Been hearing a lot about sv388linkrit, gonna give it a look. Anyone got any tips for a newbie? sv388linkrit
Trying to get that ph333comlogin sorted? Seems like login troubles are a common thing. Best of luck, bro! Have a look: ph333comlogin
Can you be more specific about the content of your article? After reading it, I still have some doubts. Hope you can help me. https://accounts.binance.com/register-person?ref=IXBIAFVY
Thinking about getting involved with Mg Bet .com! Hear their customer service is great. I need a new site that will actually respond to me: mg bet.com
Anyone else tried tigrinhobet? Thinking of throwing a few bucks their way. Let me know if you’ve had any luck!
Just tai top 88 and the game is pretty awesome! Really easy to play, loving it so far!
Thanks for sharing. I read many of your blog posts, cool, your blog is very good.
Your article helped me a lot, is there any more related content? Thanks! https://accounts.binance.info/en-ZA/register-person?ref=B4EPR6J0
24wincasino, it’s open 24 hours? Nice! Hope there are some good welcome bonuses also. Let’s GO! Check it Out! Visit 24wincasino
Jili999app on my phone? Now we’re talkin’! Hope it’s smooth and easy to use. I like this so far, so good. Try it! Click here jili999app
Yo, Bangladeshi players! Heard about 8mbetsbd. Gonna give it a shot. Hoping for some ‘bhaggoban’ luck today. Wish me luck! Check it out here 8mbetsbd
Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?
I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.
В каталоге представлены проверенные провайдеры и актуальные игровые новинки.
Pinco Casino
Регулярные акции делают игру еще более выгодной.
Yo, found ku1.1net and it’s got a certain something. Give it a whirl if you’re feelin’ lucky. You might just find your new fave spot! Check it out here: ku1.1net
Opa! Quer saber se paga mesmo? Bom, espero que sim, né? Se ganhar, não esquece de sacar rapidinho! sssgame paga
If you’re a fan of Macau football bóng đá 7m ma cao, this is the holy grail. It’s seriously the fastest and most reliable way to stay updated. I love this site!! Check it out: bóng đá 7m ma cao
It’s fascinating how gaming traditions evolve! Seeing platforms like fortune games com blend Filipino culture with modern tech is really interesting – a nod to those festive gatherings, but digital! Great article.