Introductory Note: This is one of the more serious vulnerabilities that we have reported on in the 12 year history of Wordfence as a security provider for WordPress. This vulnerability affects Really Simple Security, formerly known as Really Simple SSL, installed on over 4 million websites, and allows an attacker to remotely gain full administrative access to a site running the plugin.

The vulnerability is scriptable, meaning that it can be turned into a large scale automated attack, targeting WordPress websites. The vendor worked with the WordPress plugins team to force-update all sites running this plugin before we published this post.

You Can Help by creating as much awareness around this issue in the community as possible, ensuring that any laggard and unmaintained sites update to the patched version. We encourage hosting providers to force-update their customers and perform scans on their hosting filesystems to ensure no customer is running an unpatched version of this plugin.

It’s important to note that the Pro versions of this plugin are also affected by this vulnerability and sites running the premium versions should verify that they have automatically updated, so please do help get the word out. It appears that sites without a valid license may not have auto-updates functioning.

The Details

On November 6th, 2024, the Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in the Really Simple Security plugin, and in the Really Simple Security Pro and Pro Multisite plugins, which are actively installed on more than 4,000,000 WordPress websites. The vulnerability makes it possible for an attacker to remotely gain access to any account on the site, including the administrator account, when the two-factor authentication feature is enabled.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on November 6, 2024. Sites using the free version of Wordfence will receive the same protection 30 days later on December 6, 2024.

Wordfence contacted the Really Simple Plugins team on November 6, 2024, and received a response on November 7, 2024. After providing full disclosure details, the developer released the patch for the Pro plugins on November 12, 2024, and for the Free plugin on November 14, 2024.

Due to the critical severity of this vulnerability (CVSS score 9.8 Critical), the plugin vendor worked with the WordPress.org plugins team to push a forced security update to the patched version, 9.1.2, for anyone running a vulnerable version of the plugin. This means most sites should already be patched or will be patched soon, however, we urge users to verify that their sites were updated to the latest patched version of Really Simple Security, version 9.1.2 at the time of this writing, as soon as possible if running version 9.0.0 or newer. A thread in the WordPress.org forum for the plugin indicates that the forced updates began this morning and may continue over the next few days.

Source and more details: https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability

See also: https://www.techradar.com/pro/security/millions-of-wordpress-sites-could-be-at-risk-from-one-of-the-most-serious-plugin-flaws-ever-found

In a recent investigation by Sucuri Security a new malware campaign was discovered targeting WordPress sites through a fake plugin, universal-popup-plugin-v133, which delivers deceptive browser fix pop-ups. This malware leverages social engineering tactics to deceive visitors into downloading malicious files, compromising their systems.

Type of website impacted and the scope of infection

Sucuri reported a similar fake browser update in a recent June article. The current version of this malware affects WordPress sites, and Sucuri saw a similar case in August, 2024 which is now detected by their SiteCheck tool as malware.fake_update.7.

As of October 18th, 31 sites were known to be infected with this malware.

The malware is a Trojan that downloads from a compromised WordPress site after users are tricked into running it via fake pop-ups, where it then executes potentially harmful software on the user’s system.

How the malware works

Once installed on a compromised WordPress site, the fake plugin universal-popup-plugin-vXXX generates pop-ups that detect the user’s browser and regional language, making the attack appear more personalized and legitimate.

The Malicious Plugin Code

The plugin’s index.php file contains a malicious code that loads the JavaScript responsible for generating the fake pop-up. This code includes a JavaScript file named assets/popup.js which triggers the malicious pop-up on the frontend of the site.

The file assets/popup.js contains obfuscated code, which when decoded appends an iframe to the body of the webpage, loading the popup.html file from the plugin’s assets directory, which displays the fake browser update message.

When a user visits an infected site, they are shown an error message pop-up saying:

“Aw, Snap! Something went wrong while displaying this webpage.”

This fake error mimics legitimate browser messages, tricking users into believing that something is wrong with their browser.

The pop-up instructs the user to “install the root certificate” by clicking on a fake button labeled How to Fix. Upon clicking this button, a new pop-up appears with detailed instructions for running malicious commands on PowerShell.

The second pop-up provides the instructions to run a set of commands on your Windows PowerShell Admin that are copied on the user’s clipboard after they click the copy button. When users follow these instructions, the malicious code is executed in PowerShell, downloading an executable file.

This script hides the downloaded file from Windows Defender by adding it to an exclusion list, downloads the malicious Trojan from the specified URL, and then silently executes it on the user’s machine.

The PowerShell script retrieves an executable file named Setup.exe.

The Setup.exe file downloaded through this malicious campaign has been scanned on VirusTotal and flagged as malicious by 21 security vendors. The file is categorized as Trojan.MSIL, confirming its dangerous nature.

How does it affect the users?

Users who unknowingly execute this PowerShell script end up downloading and running a Trojan, which can have severe consequences, such as data theft, remote control of the machine, and/or further exploitation.

Prevention Tips

As a website owner, it’s important to take a proactive approach to security to mitigate risk from threats:

1. Employ a “use it or lose it” policy on your website. That means regularly review all plugins and remove any components that you don’t recognize or aren’t in use.
2. Generate strong and unique passwords for all of your accounts, including admins, FTP, database, and hosting.
3. Regularly monitor your website and check for suspicious activity or unexpected website admin users.
4. Consider using 2FA (2-factor authentication) and restricting access to your WordPress admin and sensitive pages to allow access to only trusted IP addresses.
5. Always keep your website software patched and up-to-date, including your core CMS, plugins, themes, or any other extensible components.
6. Use a web application firewall to help prevent vulnerability exploits, malicious code, and hack attempts.

[Editor’s note: steps 2,3, 5, and 6 are implemented on all ProtectYourWp client’s sites. 2FA and trusted IP address restrictions are available if you are interested. Contact us for details.]

Source and more details: https://blog.sucuri.net/2024/10/fake-fix-it-pop-ups-target-wordpress-sites-via-malicious-plugin-to-download-trojan.html