Monthly Archives: April 2025

Toll booth bandits continue to scam via SMS messages

Posted on

North American drivers are continuing to be barraged by waves of scam text messages, telling them that they owe money on unpaid tolls.

Last month we described on Hot for Security how US authorities had issued a warning about SMS phishing attacks from scammers posing as tolling agencies.

For instance, Texas-based audience producer Gwen Howerton described on Bluesky how she had been duped by an unpaid toll scam after she had driven a rental car on the Dallas North Tollway – and, not being aware of the correct way to pay a toll, had believed the overdue payment demand she received to be genuine.

The scam text messages seen in the campaigns claim that the recipient has an “outstanding toll amount” that remains unpaid, and links to a page which poses as an overdue payment portal.

You’ll notice that in both examples pictured above, the scammer is asking the recipient to perform a very specific action:

(Please reply Y and reopen the message to activate the link, or copy the link to the Safari browser for access.

The reason for this is that Apple iMessage automatically disables links received from unknown senders as a built-in protection against phishing.

Replying “Y” to the scam tricks iMessage into believing that you know the person who sent it to you, and re-enables the link.

Even if you ultimately decide not to click on the link, the fact that you may have replied with a “Y” verifies that your number if “live”, making you a prime target for future scams and spams.

The advice to members of the public is to be wary when receiving an unexpected message from an unknown source. If the message contains links then replying to it will make the links live again. Simply ignoring the text, however, will not share any information with the sender.

If you are in any doubt as to whether a message is genuine or not, consider contacting the organisation which has contacted you directly. But be careful not to trust any contact information contained within the text message itself, as this could obviously direct you straight into the clutches of the scammer.

Members of the public would be wise to report and delete unwanted text messages or forward them to 7726 (SPAM). The FTC has published information about how to recognise and respond to scam text messages here.

A year ago, the FBI’s Internet Crime Complaint Center (IC3) said it had received over 2,000 complaints about the scam messages and warned that the campaign appeared to be “moving from state-to-state.”

Source: https://www.bitdefender.com/en-us/blog/hotforsecurity/toll-booth-bandits-continue-to-scam-via-sms-messages

Interesting WordPress Malware Disguised as Legitimate Anti-Malware Plugin

Posted on

The Wordfence Threat Intelligence team recently discovered an interesting malware variant that appears in the file system as a normal WordPress plugin, often with the name ‘WP-antymalwary-bot.php’, and contains several functions that allow attackers to maintain access to your site, hide the plugin from the dashboard, and execute remote code. Pinging functionality that can report back to a Command & Control (C&C) server is also included, as is code that helps spread malware into other directories and inject malicious JavaScript responsible for serving ads.

This malware was first discovered by one of Wordfence’s security analysts during a site clean on January 22, 2025. A malware signature was developed on January 24, 2025 and released to Wordfence premium customers within three days after undergoing our QA process. Customers using the free version of Wordfence received the same signature on February 26, 2025 after a 30 day delay. New versions of the malware have since surfaced, all which are detected by the malware signature released back in January. However, for added protection Wordfence released a firewall rule on April 23, 2025 to all Wordfence paid users preventing execution of the file. Site owners using the free version of the Wordfence plugin will receive the same added coverage on May 23, 2025.

Source and more details: https://www.wordfence.com/blog/2025/04/interesting-wordpress-malware-disguised-as-legitimate-anti-malware-plugin

Privilege Escalation Vulnerability Patched in Better Find and Replace Plugin

Posted on

This blog post is about the Better Find and Replace plugin vulnerability. If you’re a Better Find and Replace user, please update the plugin to at least version 1.6.8.

About the Better Find and Replace Plugin

The plugin Better Find and Replace which has over 50,000 active installations, is one of the popular search and replace plugins in the WordPress ecosystem. It allows users to quickly find and replace different texts in the posts, meta and database. This plugin is developed by CodeSolz.

According to their official WordPress plugin page, “The plugin provides an optimized search and replace function, providing an effective solution for efficient database management. Additionally, it incorporates a dynamic real-time word/text replacing feature.”

Since it allows search/replace in the database itself, it can be a problematic issue if low-privileged users are able to search/replace the content. This is exactly what happened with the plugin leading to a subscriber user relacing their privilege to an administrator.

The security vulnerability

The plugin (version 1.6.7 and below) suffers from a privilege escalation vulnerability. The vulnerability occurred due to the leakage of the nonce to low-privileged users and the lack of proper permission checks in the function that is responsible for replacing the texts in the database. The vulnerability has been tracked as CVE-2025-24734.

The routing of the plugin has been done in an interesting way. Instead of following the traditional ajax hook method, a class/method-based approach is used to route the requests.

The patch

The vendor patched the issue by adding a strict check for sufficient permission to execute the method.

Conclusion

It is always crucial to ensure that a user’s permission check is not solely reliant on nonce. In case the nonce is leaked somewhere, any user has access to sensitive actions and functions. Along with the nonce check, a strong permission check is important to ensure vulnerability like this one is not introduced in the codebase.

Source and more details: https://patchstack.com/articles/privilege-escalation-vulnerability-patched-in-better-find-and-replace-plugin/

50,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Greenshift WordPress Plugin

Posted on

On April 14th, 2025, Wordfence received a submission for an Arbitrary File Upload vulnerability in Greenshift, a WordPress plugin with more than 50,000 active installations. This vulnerability can be used by authenticated attackers, with subscriber-level access and above, to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover.

Props to mikemyers who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This vulnerability was reported to our program just five days after it was introduced. This researcher earned a bounty of $1,229.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.

All paid Wordfence customers as well as those using the free version of the plugin are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in Malicious File Upload protection.

Wordfence provided full disclosure details to the GreenShift team on April 14, 2025. The developer released the first patch the next day, April 15, 2025, and the second patch on April 17, 2025. We would like to commend the GreenShift team for their prompt response and timely patch.

This vulnerability is an incredible example of the positive impact the Wordfence Bug Bounty Program has on the WordPress ecosystem. This vulnerability was introduced on April 10th, 2025, and just four days later it was reported to our Bug Bounty Program, triaged, sent to the developer, and patched the next day, creating a narrow opportunity for attackers to discover and exploit this vulnerability before site owners were protected. Extra special kudos to the researcher mikemyers for discovering this vulnerability so quickly and to GreenShift for remediating the vulnerability so quickly.

We urge users to update their sites with the latest patched version of Greenshift, version 11.4.6 at the time of this publication, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2025/04/50000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-greenshift-wordpress-plugin

Millions of email users at risk — passwords could be exposed to hackers, experts warn

Posted on

3.3 million email services don’t have encryption enabled, online security watchdog finds

New research from security experts has revealed over 3 million mail servers are still using an aging protocol without encryption enabled, leaving millions of usernames and passwords vulnerable to hackers.

This week the Shadowserver Foundation, a nonprofit security organization, pushed out an alert on X and that it found 3.3 million POP3 and IMAP servers are operating without transport layer security (TLS) encryption enabled. To translate, POP3 (Post Office Protocol version 3) is an aging protocol used by email clients to access emails from a mail server, and it’s often used alongside the newer protocol IMAP (Internet Message Access Protocol). TLS encryption, meanwhile, is a protocol that encrypts the communication between web applications and servers, preventing hackers from intercepting potentially sensitive information while you’re chatting or checking your email.

Without TLS encryption enabled during transmission, both the contents of your messages and your log-in credentials like username and password are sent in plain text, leaving that information out there for any bad actor to come across using eavesdropping networks.

“We have started notifying about hosts running POP3/IMAP services without TLS enabled, meaning usernames/passwords are not encrypted when transmitted,” the ShadowServer Foundation said.

Almost 900,000 of these sites are based in the U.S., with another 560,000 and 380,000 in Germany and Poland respectively, the organization found, adding: “We see around 3.3M such cases with POP3 & a similar amount with IMAP (most overlap). It’s time to retire those!” You can check out vulnerability reports for both POP3 email servers and IMAP email hosts on the Shadowserver Foundation site.

How to stay safe amid threat of email password exposure

Email service providers have been using TLS to encrypt messages for decades, and Microsoft began enabling the latest version, TLS 1.3, by default with Windows 11. Though the Shadowserver Foundation warned that “regardless of whether TLS is enabled or not, service exposure may enable password-guessing attacks against the server.”

The organization advised all email users to check with their email service provider to be sure that TLS is enabled and the latest version of the protocol is being used. Thankfully, the latest versions of Apple, Google, Microsoft and Mozilla email platforms all enable TLS, so users there can rest assured that their information is already safeguarded.

Source: https://www.tomsguide.com/computing/online-security/millions-of-email-users-at-risk-passwords-could-be-exposed-to-hackers-experts-warn

6,000 WordPress Sites Affected by Arbitrary File Move Vulnerability in Drag and Drop Multiple File Upload for WooCommerce WordPress Plugin

Posted on

On March 28th, 2025, we received a submission for an Arbitrary File Move vulnerability in Drag and Drop Multiple File Upload for WooCommerce, a WordPress plugin with more than 6,000 active installations. This vulnerability makes it possible for unauthenticated threat actors to move arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.

Props to Phat RiO – BlueRock who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $315.00 for this discovery.

All paid Wordfence customers as well as those using the free version of our plugin, are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in Local File Inclusion protection.

We provided full disclosure details to Glen Don Mongaya on March 28, 2025. The developer released the fully patched version on April 4, 2025. We would like to commend Glen Don Mongaya for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of Drag and Drop Multiple File Upload for WooCommerce, version 1.1.5 at the time of this writing, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2025/04/6000-wordpress-sites-affected-by-arbitrary-file-move-vulnerability-in-drag-and-drop-multiple-file-upload-for-woocommerce-wordpress-plugin

Password managers are under threat in 2025. What the LastPass breach taught us.

Posted on

Hackers know to target your password managers now. Here’s what you should do.

Back in August 2022, password manager LastPass suffered a massive breach.

A still-unknown cyber criminal successfully targeted one of LastPass’ four DevOps engineers who had access to the decryption keys for the cloud storage service. Using the engineer’s stolen credentials, the hacker was able to infiltrate LastPass’ systems undetected. This breach lasted for months and continued even after LastPass believed the threat had been contained.

The LastPass breach enabled the threat actor to obtain access to the “backup customer vault data.” According to the company, encrypted data such as usernames and passwords as well as unencrypted data like website URLs were affected.

Breaches at large companies and online platforms are not new. In the case of the LastPass breach, hackers don’t need to find some technical flaw to exploit either.

By targeting the human beings who work at these companies, using tactics such as social engineering, every organization technically has a weakness that can be taken advantage of.

However, the LastPass breach was different. 

Hackers breached a password manager, a platform meant to protect your passwords and make it possible to use highly secure credentials for each of your logins. And it proved highly successful for the hackers.

Breaching password managers highly lucrative for hackers

Over the past few months, there have been a number of reports detailing how the LastPass breach appears to be linked to cryptocurrency-related heists. Hundreds of millions of dollars have allegedly been stolen allegedly as a result of the LastPass breach.

In one such incident, U.S. federal investigators claim that the LastPass breach seems to be the source of a cryptocurrency heist that resulted in $150 million being stolen from a crypto wallet last year. Authorities arrived at this conclusion after finding that the login credentials were stored in the victim’s password manager. In addition, investigators did not find any evidence that the victim’s devices were hacked.

And it appears that the worst is yet to come. 

Thanks to the hackers’ success with the LastPass intrusion, password managers are now under attack. Hackers have realized that instead of wasting time breaking into one platform at a time when targeting a user, they can gain access to all of their login credentials if they can break into their target’s password manager.

Here’s a great example of how hackers are honing in on password managers and even getting creative in order to target them.

Just a year and a half after the LastPass breach, a threat actor was somehow able surpass Apple’s usually stringent review process in order to convince the company to approve a fake LastPass app in the App Store. The LastPass imposter was basically a phishing app that attempted to fool LastPass users into believing it was the official app so they would input their login credentials, which would then go right to the bad actor who created it. It’s unclear how many, if any, LastPass users were affected by this specific incident, but it shows what great lengths cyber criminals are going to in targeting password managers.

But, don’t be fooled into thinking this is just about LastPass. Hackers are targeting password managers in general. A new report released last month from cybersecurity firm Picus Security found that 25 percent of all malware is now targeting password managers or other credential storage services. 

“Threat actors are leveraging sophisticated extraction methods…to obtain credentials that give attackers the keys to the kingdom,” said Picus Security co-founder and VP of Picus Labs, Dr. Suleyman Ozarslan.

How to protect yourself from password manager breaches

There are a few lessons here going forward.

For one, we can no longer assume that just because you’re using a password manager that your login credentials are somehow more secure. It might be more convenient to use, but breaches can still happen.

Users looking into password managers should should also prioritize encryption. Hackers were able to obtain plain-text website URLs in the LastPass hack. While this may not seem crucial on its own, it provides hackers with a blueprint basically. It shows what platforms you have accounts on, which can be an extremely important tool for a hacker looking to craft a phishing email.

It might not have been as easy to obtain the login credentials themselves, but they knew exactly where to go and how to target users in order to gain unauthorized access. In May 2024, LastPass learned from its mistakes and the company announced it was rolling out URL encryption.

But, the most important lesson is the importance of two-factor authentication. Yes, you may use a password manager in order to make the login process as easy as possible and two-factor authentication will require that you input credentials to get passed yet another layer of security. But, even if a hacker were to break into your password manager and steal your password, they still couldn’t access your account unless they had access to your physical mobile device.

Also, in the event that your password manager is breached, you’ll need to change your password. No, not just your master password. You should change your password for each and every platform with a login credential saved in your password manager.

Source: https://mashable.com/article/password-manager-breaches-lastpass-lessons-learned

See also: https://www.techradar.com/pro/security/security-attacks-on-password-managers-have-soared

100,000 WordPress Sites Affected by Administrative User Creation Vulnerability in SureTriggers WordPress Plugin

Posted on

On March 13th, 2025, Wordfence received a submission for an Unauthenticated Administrative User Creation vulnerability in SureTriggers, a WordPress plugin with more than 100,000 active installations. This vulnerability can be leveraged by attackers to create malicious administrator users when the plugin is not configured with an API key.

Props to mikemyers who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,024.00 for this discovery.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on April 1, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on May 1, 2025.

Wordfence contacted the Brainstorm Force team on April 3, 2025, and received a response on the same day. After providing full disclosure details, the developer released the patch on the same day, April 3, 2025. We would like to commend the Brainstorm Force team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of SureTriggers, version 1.0.79 at the time of this writing, as soon as possible.

Source: https://www.wordfence.com/blog/2025/04/100000-wordpress-sites-affected-by-administrative-user-creation-vulnerability-in-suretriggers-wordpress-plugin

2024 Wordfence Vulnerability Year in Review

Posted on

Highlights from the Wordfence 2024 WordPress Security Report

  • Vulnerabilities disclosed in 2024 increased by 68% from 2023.
  • 81% of vulnerabilities disclosed in 2024 had a ‘Medium’ severity CVSS score.
  • Contributor-level access was the most common access requirement to exploit vulnerabilities in 2024, accounting for 34% of all vulnerabilities disclosed.
  • Approximately 35% of all vulnerabilities disclosed in 2024 remain unpatched in 2025.
  • 58% of all vulnerabilities disclosed in 2024 were in software with fewer than 10,000 active installations, and 19% of all vulnerabilities disclosed were in software with 50,000 active installations or more. 
  • Cross-Site Scripting vulnerabilities were the #1 vulnerability type disclosed in 2024, with Contributor-level Cross-Site Scripting vulnerabilities accounting for 56% of that total. 
    • Only around 5.7% of Cross-Site Scripting vulnerabilities had minimal authentication requirements and no user interaction requirements to exploit. 
    • 23% of all Cross-Site Scripting vulnerabilities from 2024 were Reflected Cross-Site Scripting.
  • Cross-Site Request Forgery vulnerabilities are on a comparative decline from previous years.  
  • 7.4% of all vulnerabilities disclosed in 2024 were considered high-threat (i.e. likely to be exploited with a damaging impact). This was a 149% increase from the number of high-threat issues disclosed in 2023. Arbitrary File Uploads were the most common vulnerability type disclosed in this category, with Privilege Escalation in second place. 
  • Over 68% of all vulnerabilities disclosed are considered low-risk to most WordPress site owners based on authentication level or user interaction requirements to exploit.  
  • Plugin vulnerabilities remain the biggest software threat to WordPress, accounting for 96% of all vulnerabilities disclosed.
  • Wordfence blocked and logged over 54 billion malicious requests, and blocked over 55 billion password attacks in 2024. 
  • Cross-Site Scripting exploit attempts were the number one blocked with 9 billion requests blocked in 2024, and SQL Injection was next with 1.1 billion requests blocked. 
  • LiteSpeed Cache <= 6.3.0.1 – Unauthenticated Privilege Escalation vulnerability was the number one targeted vulnerability in 2024 based on our custom firewall rules. This is likely due to the brute force requirements to successfully exploit and the fact that it is an attractive target.  
  • Password attacks overall are on the decline and exploits targeting software vulnerabilities are on the incline as of the end of 2024. 

Key Takeaways and Recommendations for 2025

  • Expect the trend of increased vulnerability disclosures to continue through 2025 as bug bounty programs and CNA roles continue to drive more research. While the sheer number may seem daunting, the majority remain low-risk if proper defenses (such as WAFs, continuous monitoring, and prompt patching) are in place.
  • Developers need to establish clear methods of communication for responsible disclosure as the number of vulnerabilities reported continues to rise. 
  • Layered security and defense in depth is going to be critical for WordPress site owners security through 2025 and beyond.
  • Threat actors are shifting attack techniques on WordPress, likely due to an overall improved posture of software security in the WordPress ecosystem as a result of more responsible disclosure and general security awareness from site owners.   
  • Security education and awareness will be crucial to continue growth and continue improving the posture of security in WordPress through 2025 and beyond.
  • Site owners need to proactively protect their sites by following security best practices and utilizing various security tools like a Web Application Firewall, Malware Scanner, Vulnerability Scanner, 2-Factor Authentication, and more. 
  • Removing unused and abandoned WordPress plugins and themes may be critically important in 2025 and beyond.

Read the full report: https://www.wordfence.com/wp-content/uploads/2025/04/2024-Annual-WordPress-Security-Report-by-Wordfence.pdf