A new Trojan spy known as SparkKitty targets information from screenshots stored in your gallery. This spy, likely connected to the infamous SparkCat data stealer that emerged earlier this year, focuses on sensitive data, such as seed phrases for crypto wallets. The new Trojan was first mentioned on SecureList by Kaspersky.
According to Kaspersky, the malware targets iOS and Android devices. While the malware spread from the App Store and Google Play Store (and has been removed from both), it’s also spreading naturally.
What is SparkKitty?
Here’s how the malware works. Kaspersky said it identified one version of the Trojan that copies all images in your gallery and another that uses OCR to find images specifically related to financial information.
If you have any cryptocurrency, you were probably encouraged to write down a seed phrase when you created your wallet and store it in a secure, offline location. This phrase is crucial for restoring a wallet and its contents on a device other than the original, which makes it an attractive target for thieves. While writing the phrase down is optimal, many people take a screenshot to remember it later.
The malware comes from legitimate-looking downloads, including messaging apps, crypto trading apps, modded TikTok clones, fake online cryptocurrency stores, gambling apps, adult-themed games, and casino apps.
If you accidentally install the software, it searches your gallery and sends your data to nefarious parties who can wipe out your wallet or target your other accounts.
How to keep safe from SparkKitty
If you want to keep yourself protected from this (or any other) malware, there are a few steps you can take:
Go to your phone’s settings and check each app’s permissions. Revoke access to camera, photos, storage, and accessibility features unless the app needs it (for example, a wallpaper app doesn’t need access to your files).
Only install apps from official app stores like the Google Play and the App Store (but even then, be aware that malware can slip through, as SparkKitty did).
Don’t save screenshots of sensitive information, such as IDs, passports, crypto wallets, seed phrases, passwords, and two-factor authentication backup codes. Either delete this data or move the screenshots to a password-protected folder.
The Wordfence Threat Intelligence Team recently identified an interesting malware family on May 16, 2025 during a site clean. This malware family shared a codebase but varied in features across different versions, including credit card skimming and WordPress credential theft. Most surprisingly, one variant incorporated a live backend system hosted directly on infected websites for attacker use – a previously unseen method – packaged and disguised as a rogue WordPress plugin.
Further research uncovered evidence of this campaign in the Threat Intelligence platform dating back to September 2023, indicating a prolonged operation targeting multiple entities. Analysis of the malware’s growing codebase of more than 20 samples provided unique insights into the evolution of this framework.
Several malware detection signatures were developed and released after undergoing the Wordfence Q&A process between May 17 and June 15, 2025. All paid Wordfence customers received these signatures immediately, along with paid Wordfence CLI Users. Users of the free versions of Wordfence and Wordfence CLI receive the same signatures after the standard 30-day delay.
As part of their product lineup, Wordfence offers security monitoring and malware removal services. In the event of a security incident, their incident response team will investigate the root cause, find and remove malware from your site, and help with other complications that may arise as a result of an infection. During the cleanup, malware samples are added to their Threat Intelligence database, which contains over 4.4 million unique malicious samples. The Wordfence plugin and Wordfence CLI scanner detect over 99% of these samples and indicators of compromise, when using the premium signature set. Wordfence CLI can scan your site even if WordPress is no longer functional and is an excellent layer of security to implement at the server-level, part of their mission to secure the web by Defense in Depth.
Malware Analysis: Shared Features
All of the malware samples analyzed employ identical obfuscation techniques and often incorporate anti-analysis measures to evade detection. Common anti-analysis features observed include developer tools detection and console rebinding. Other shared features are found in most samples, suggesting an ongoing development effort over the years.
Developer Tools Detection and Analysis Evasion
To evade analysis, malware often employs a technique to detect if a browser’s developer tools (like Firefox Developer Tools or Chrome DevTools) are active: if detected, the malware – when properly implemented – will often alter its behavior to avoid detection in the console.
The code continuously checks the difference between window.outerWidth / outerHeight and window.innerWidth / innerHeight and dispatches a custom devtoolschange event with the details. A significant difference may indicate the developer tools are open. In most samples the data collection and exfiltration logic is designed to check the developer tools status before proceeding.
Further investigation unveiled even more advanced anti-analysis techniques in certain samples, like infinite loops and debugger traps.
The code is designed to effectively block analysis, either by creating and executing a function containing an infinite while(true) loop intended to freeze or crash a browser tab or the developer tools, or programmatically inserting debugger statements that will pause execution if developer tools are open.
Some malware samples also included functionality to prevent the use of typical browser debugging shortcuts. For instance the code deactivates right-click context menus, the F12 key (commonly used to access browser debug tools), Ctrl + Shift + I / J (methods to open developer tools or the browser console), and Ctrl + U (for viewing page source).
Console Rebinding
Later iterations of this malware incorporate a sophisticated mechanism for dynamically rebinding console methods within the browser environment: this advanced anti-analysis technique is specifically designed to obstruct reverse engineering efforts and slow debugging processes.
Targeted Execution
All of the malware variants Wordfence analyzed include checks to limit their activity to specific website areas. For example, they avoid running in the WordPress admin panel to prevent detection, or ensure they operate only on checkout pages. Some variants use cookies to recognize and evade site administrators and users who have already had their information stolen.
Recent variants of this malware also include a list of disallowed email address and domain names which is later checked against billing data, likely to avoid targeting specific accounts, and again in order to evade detection.
Form Manipulation
Most of the malware variants use techniques like form manipulation, injection, overlays, or hijacking to steal payment and billing information. These methods varied based on the website and integrated payment gateways; sometimes multiple approaches are combined. The prevalent technique involved directly intercepting payment and billing data from HTML forms.
Another common implementation consists in a Base64 encoded string containing the HTML code to resemble a fake payment form, which is then appended to the legitimate WooCommerce payment box.
In some cases Wordfence observed a form overlay technique similar to the one found in a sophisticated & stealthy formjacking malware recently analyzed, even though this malware family differs in several ways – most notably a different approach to persistence and resilience – while still repurposing legitimate web technologies for uses that directly undermine security and privacy, albeit in a different way.
For instance the malware makes use of localStorage to store configuration data within a victim’s browser. This technique allows the malware to persist and maintain its presence across browsing sessions, even without directly manipulating cookies.
Other variants opted for a direct manipulation of the generated HTML code, in some cases even adding pseudo-validation in order to provide visual feedback, making the tampered form appear legitimate.
One sample inspected also included a surprisingly complete fake human verification challenge, dynamically injected as a fullscreen and multi-language screen, intended to serve both as a user deception device and as an anti-bot filter.
This includes incredibly advanced features for malware, like text localized in multiple languages, CSS support for RTL languages and dark mode, interactive elements like animations and spinning SVGs, and a definite Cloudflare brand impersonation, revealing a complexity rarely encountered before.
Data Exfiltration
Almost all of the malware variants use the same method to exfiltrate billing and payment data using custom encoding. Once collected, all data is concatenated into a single string then Base64 encoded and further encoded via a custom scheme, alternating a “percent” character.
In most cases the stolen data is encoded and appended as a query parameter to a fake image URL hosted on an attacker controlled server, triggering an HTTP GET request to exfiltrate the data.
Furthermore, the server, path, and query parameters varied across analyzed samples, complicating detection efforts.
In one case Wordfence also found a notable post-skim action. After successful exfiltration, the script hides the injected form and significantly manipulates an error message code to display a fake payment gateway error. This is a highly deceptive social engineering tactic, designed to explain the failed transaction to the end user delaying suspicion about the data theft.
Non-Skimming Variants
Wordfence analysis involved a detailed examination of several malware samples, revealing some diversity in their underlying logic and intended functionality while still retaining most of the shared features. Even though most samples exhibited characteristics consistent with credit card skimming operations, their investigation uncovered three distinct variants.
These variants appear to be specifically engineered for a range of different malicious activities, including manipulation of Google Ads for fraudulent purposes, theft of WordPress login credentials, and distribution of further malware payloads to the end users, effectively denominating this malware family as a framework.
The malware variant specializing in malicious advertising kept most of its original functionalities but replaced the formjacking and data theft components. Instead, it was designed to selectively show ads if a user arrived from a known search engine or social media platform and was on a mobile device.
A different version of the malware targeted WordPress login credentials and other user data. It employed the same data theft and exfiltration techniques seen in previously analyzed samples.
This malware framework was also used to dynamically replace links on infected websites with attacker-controlled ones. This allowed for the further spread of malware by distributing malicious versions of the originally linked content to users.
User Tracking And Profiling
Certain malware samples, primarily designed for malicious advertising, utilized sophisticated tracking and profiling methods. These techniques gathered information about the user’s browser, operating system, and device type, and also categorized them based on traffic sources like search engines, social media, email, mobile apps, and referrals. To increase effectiveness and avoid serving ads to search engine bots a mechanism was implemented to identify and filter out automated tools, allowing for the collection of statistics specifically from genuine users.
Wordfence also observed a refined target reconnaissance routine aimed at targeted payload delivery, an evolution of previously observed similar code. All the information is encoded and appended as parameters to the remote payload URL, allowing attackers to receive detailed contextual information about the target, likely in order to deliver the most appropriate payload via a dynamic script inclusion.
Logging and Telemetry
Some malware samples use a direct Telegram channel for immediate and secret exfiltration of sensitive data from compromised systems in real time. This includes personal information like system and browser details. The malware also monitors and transmits user actions and identifies the compromised website or the site active during the attack, allowing attackers to understand the breach context and refine their targeting.
Malware Evolution: A Rogue WordPress Plugin
The exploration of these sophisticated malware features has been insightful, with most functionality aligning with expectations. However, certain samples displayed unique characteristics, indicating sustained and distinctive development efforts.
The initial sample was bundled with a deceptive fake WordPress plugin. This unconventional tactic of pairing skimming malware with a plugin, contrary to typical attacker strategies aimed at evading detection, immediately drew the Wordfence analyst’s attention.
The plugin presents itself as well structured, following common development best practices such as separated folders for administrative and public facing code. However – unlike a recently analyzed malware masquerading as a legitimate WordPress plugin – a quick inspection would reveal most files to be just empty scaffolding. Clearly the fake plugin was not affiliated in any way with WordPress or WooCommerce, even though it’s a fairly common tactic used by attackers to deceive their victims.
Both the code features and style indeed suggests the plugin template was likely generated by AI (Wordfence were able to track down some code features from publicly available code snippets). However some characteristics would catch the eye, like the misspelling of “WordPress” in the plugin name or the vague plugin description:
The actual credit card skimmer is found in wordpress-core-public.js. It is designed to directly skim data from existing, legitimate form fields on the page and it is highly selective about where and when it executes, targeting only the checkout page and avoiding administrative users as discussed before.
In addition to the credit card skimmer, the plugin contained PHP files that allow it to act as a server-side building block to complement this attack, effectively converting the compromised website into a custom interface available to the attackers.
The code found in the register-messages-posttype.php file creates a “messages” custom post type, which is used as backend infrastructure for collecting and managing the stolen data, and provides a custom link into the “My Account” view for convenience, which would allow users of any level access to the store orders despite the lack of capabilities.
Furthermore, the malicious code found in wordpress-core.php extends the skimming attack to the website backend, in order to ensure that the fraudulent transactions remain undetected and unprocessed as long as possible. This is achieved by leveraging the available hooks woocommerce_thankyou and wp_footer with routines to periodically scan the database for orders in progress and update their status to “wc-completed” in an attempt to evade or at least delay detection.
This rogue WordPress plugin represents a significant escalation for credit card skimmers. While the JavaScript code is responsible for capturing payment data and billing information, the PHP counterparts act as a backend directly on the compromised website.
Indicators of Compromise
The analyzed malware samples employed significant obfuscation, using a widely recognized algorithm, to evade detection; the same obfuscation technique is also frequently used by commercial plugins and themes to protect their intellectual property.
While common, this practice presents a challenge for malware analysts in developing reliable signatures for known threats. This may lead to occasional false positive detections for legitimate premium software, and complicates the listing of indicators of compromise.
In today’s blog post Wordfence highlighted an interesting malware family targeting various systems with diverse capabilities, including stealing credit card information and WordPress credentials. Additionally, Wordfence detailed a novel bundle of credit card skimmers and malicious WordPress plugins which combines malicious actions with features developed for the attacker’s convenience.
Wordfence paid customers received malware signatures to detect these infected plugins between May 17 and June 15, 2025. Wordfence free users and Wordfence CLI free users receive signatures after a 30 day delay.
Threat actors with suspected ties to Russia have been observed taking advantage of a Google account feature called application specific passwords (or app passwords) as part of a novel social engineering tactic designed to gain access to victims’ emails.
Details of the highly targeted campaign were disclosed by Google Threat Intelligence Group (GTIG) and the Citizen Lab, stating the activity seeks to impersonate the U.S. Department of State.
“From at least April through early June 2025, this actor targeted prominent academics and critics of Russia, often using extensive rapport building and tailored lures to convince the target to set up application specific passwords (ASPs), GTIG researchers Gabby Roncone and Wesley Shields said.
“Once the target shares the ASP passcode, the attackers establish persistent access to the victim’s mailbox.”
The activity has been attributed by Google to a threat cluster it tracks as UNC6293, which it says is likely affiliated with the Russian state-sponsored hacking group called APT29 (aka BlueBravo, Cloaked Ursa, CozyLarch, Cozy Bear, ICECAP, Midnight Blizzard, and The Dukes).
The social engineering unfolds over a span of several weeks to establish rapport with targets, rather than induce a sense of pressure or urgency that may have otherwise raised suspicion.
This involves sending benign phishing emails disguised as meeting invitations that include no less than four different fictitious addresses with the “@state.gov” email address in the CC line to lend it a veneer of credibility.
“A target might reason ‘if this isn’t legitimate, surely one of these State Department employees would say something, especially if I reply and keep them on the CC line,'” the Citizen Lab said.
“We believe that the attacker is aware that the State Department’s email server is apparently configured to accept all messages and does not emit a ‘bounce’ response even when the address does not exist.”
This indicates that these attacks are meticulously planned and executed to trick victims into parting with a 16-digit passcode that gives the adversary permission to access their mailbox under the pretext of enabling “secure communications between internal employees and external partners.”
Google describes these app passwords as a way for a less secure app or device the ability to access a user’s Google account that has two-factor authentication (2FA) enabled.
“When you use 2-Step Verification, some less secure apps or devices may be blocked from accessing your Google account,” per the company. “App passwords are a way to let the blocked app or device access your Google account.”
The initial messages are designed to elicit a response from the target to set up a meeting, after which they are sent a PDF document that lists a series of steps to create an app password in order to securely access a fake Department of State cloud environment and share the code with them.
“The attackers then set up a mail client to use the ASP, likely with the end goal of accessing and reading the victim’s email correspondence,” GTIG said. “This method also allows the attackers to have persistent access to accounts.”
Google said it observed a second campaign bearing Ukrainian themes, and that the attackers logged into victim accounts mainly using residential proxies and VPS servers to evade detection. The company said it has since taken steps to secure the accounts compromised by the campaigns.
UNC6293’s ties to APT29 stem from a series of similar social engineering attacks that have leveraged novel techniques like device code phishing and device join phishing to gain unauthorized access to Microsoft 365 accounts since the start of the year.
Device join phishing is particularly noteworthy for the fact that it tricks victims into sending back to the attackers a Microsoft-generated OAuth code to hijack their accounts.
“Since April 2025, Microsoft has observed suspected Russian-linked threat actors using third-party application messages or emails referencing upcoming meeting invitations to deliver a malicious link containing valid authorization code,” Microsoft revealed last month.
“When clicked, the link returns a token for the Device Registration Service, allowing registration of the threat actor’s device to the tenant.”
Researchers identify a previously unknown ClickFix variant exploiting PowerShell and clipboard hijacking to deliver the Lumma infostealer via a compromised travel site.
ClickFix uses social engineering to trick users into loading LOLBINS malware on their own devices, in this case using PowerShell. With evasion built into the ClickFix code and PowerShell execution undertaken in memory, the presence of ClickFix malware is easily missed.
On June 13, 2025, researchers at Todyl, a networking and security platform for MSPs, detected a ClickFix variant that has not previously been seen. It was found on a compromised WordPress travel site being used in a traditional waterholing attack.
Visitors to the site seeking a holiday in the Galapagos would receive a pop-up dialog box purporting to be part of Cloudflare’s CAPTCHA security process. The social engineering process is not new, being similar to that used in the variant discussed by SlashNext in early June.
Both attacks aim to persuade the user that similar additional steps are required to complete Cloudflare’s Turnstile CAPTCHA process. In this new example, a banner at the bottom of the box claims ‘Performance & Security by Cloudflare’.
The visitor is required to press ‘Windows + R’ followed by ‘CTRL + V’ followed by ‘OK’. By this time the compromised website has already loaded the first PowerShell command into the user’s clipboard. The Run dialog box is opened, ClickFix is pasted into it, and the code is executed.
The first command is heavily obfuscated, so even if briefly seen by the visitor, it will probably be unrecognizable. The obfuscated command is seen by a human as:
This command uses PowerShell’s invoke-RestMethod to link to a separate C2 domain (cmbkz8kz1000108k2carjewzf[.]info). The response from the C2 will then be executed by PowerShell’s Invoke-Expression.
Todyl’s researchers found and executed this ClickFix. They discovered that the ultimate malware payload delivered is the Lumma infostealer – but they have many unanswered questions. For example, is the Russia-based source of Lumma (known as ’Shamel’) also the source of this ClickFix; is a separate developer of this ClickFix using Lumma as a service; or are both ends of the equation affiliates of different as- a-service sources? How widespread is this variant? What is the criminal infrastructure?
Todyl will continue to research LightPerlGirl. (The name comes from a surprising copyright notice within the ClickFix code: “(Copyright (c) LightPerlGirl 2025)”.) “We believe it is a brand new and novel campaign,” David Langlands, Todyl’s CSO, told SecurityWeek. His wider research into the extent of LightPerlGirl’s use and the infrastructure it uses will take a while — but since the malware is already in the wild, he decided to publish details of the current code immediately, complete with known IOCs.
Malicious use of PowerShell can be detected by the latest security tools, but ClickFix attempts to avoid them. The wateringhole attack method, which can be supported by malvertising, is not a finely targeted attack. The adversaries have no control over who may visit the site and become infected. However, the use of a compromised travel site would be attractive to individuals sufficiently wealthy to seek an expensive vacation (the Galapagos), and they would likely do so from home on their own PC. Such devices are not often protected by modern EDR – so the ClickFix use of LOLBINS would pass unseen.
The result would be a well-off individual, possibly a company executive, unknowingly infected by an infostealer which could subsequently and potentially learn from the personal computer how to access the employer’s enterprise network. This is the real danger of ClickFix: the compromise of individual employees ultimately leading to the compromise of major employer enterprises.
Todyl only found this new ClickFix variant because one of its corporate customers happened to visit the infected website. An attack that normally avoids exposure to modern detection systems, was discovered almost accidentally.
Hacked credentials could give cybercriminals access to Facebook, Meta and Google accounts among others
Internet users have been told to change their passwords and upgrade their digital security after researchers claimed to have revealed the scale of sensitive information – 16bn login records – potentially available to cybercriminals.
Researchers at Cybernews, an online tech publication, said they had found 30 datasets stuffed with credentials harvested from malicious software known as “infostealers” and leaks.
The researchers said the datasets were exposed “only briefly” but amounted to 16bn login records, with an unspecified number of overlapping records – meaning it is difficult to say definitively how many accounts or people have been exposed.
Cybernews said the credentials could open access to services including Facebook, Apple and Google – although there had been no “centralised data breach” at those companies.
Bob Diachenko, the Ukrainian cybersecurity specialist behind the research, said the datasets had become temporarily available after being poorly stored on remote servers – before being removed again. Diachenko said he was able to download the files and would aim to contact individuals and companies that had been exposed.
“It will take some time of course because it is an enormous amount of data,” he said.
Diachenko said the information he had seen in infostealer logs included login URLs to Apple, Facebook and Google login pages. Apple and Facebook’s parent, Meta, have been contacted for comment.
A Google spokesperson said the data reported by Cybernews did not stem from a Google data breach – and recommended people use tools like Google’s password manager to protect their accounts.
Internet users are also able to check if their email has been compromised in a data breach by using the website haveibeenpwned.com. Cybernews said the information seen in the datasets followed a “clear structure: URL, followed by login details and a password”.
Diachenko said the data appeared to be “85% infostealers” and about 15% from historical data breaches such as a leak suffered by LinkedIn.
Experts said the research underlined the need to update passwords regularly and adopt tough security measures such as multifactor authentication – or combining a password with another form of verification such as a code texted from a phone. Other recommended measures include passkeys, a password-free method championed by Google and Facebook’s owner, Meta.
“While you’d be right to be startled at the huge volume of data exposed in this leak it’s important to note that there is no new threat here: this data will have already likely have been in circulation,” said Peter Mackenzie, the director of incident response and readiness at the cybersecurity firm Sophos.
Mackenzie said the research underlined the scale of data that can be accessed by online criminals.
“What we are understanding is the depth of information available to cybercriminals.”
He added: “It is an important reminder to everyone to take proactive steps to update passwords, use a password manager and employ multifactor authentication to avoid credential issues in the future.”
Toby Lewis, the global head of threat analysis at the cybersecurity firm Darktrace, said the data flagged in the research is hard to verify but infostealers – the malware reportedly behind the data theft – are “very much real and in use by bad actors”.
He said: “They don’t access a user’s account but instead scrape information from their browser cookies and metadata. If you’re following good practice of using password managers, turning on two-factor authentication and checking suspicious logins, this isn’t something you should be greatly worried about.”
Cybernews said none of the datasets have been reported previously barring one revealed in May with 184m records. It described the datasets as a “blueprint for mass exploitation” including “account takeover, identity theft, and highly targeted phishing”.
The researchers added: “The only silver lining here is that all of the datasets were exposed only briefly: long enough for researchers to uncover them, but not long enough to find who was controlling vast amounts of data.”
Alan Woodward, a professor of cybersecurity at Surrey University, said the news was a reminder to carry out “password spring cleaning”. He added: “The fact that everything seems to be breached eventually is why there is such a big push for zero trust security measures.”
On May 2nd, 2025, Wordfence received a submission for a Privilege Escalation vulnerability in Motors, a WordPress theme with more than 22,000 sales. This vulnerability makes it possible for an unauthenticated attacker to change the password of any user, including an administrator, which allows them to take over the account and the website. We originally disclosed this vulnerability on May 19th, 2025 and our records indicate that attackers started exploiting the issue the next day on May 20th, 2025. It appears mass exploitation started on June 7th, 2025. The Wordfence Firewall has already blocked over 23,100 exploit attempts targeting this vulnerability.
Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on May 6, 2025. Sites using the free version of Wordfence received the same protection after the standard 30-day delay on June 5, 2025.
We urge users to ensure their sites are updated with the latest patched version of Motors, version 5.6.68 at the time of this writing, as soon as possible, as this vulnerability is under active exploitation.
On May 21st, 2025, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Insufficient Authorization to Privilege Escalation via MCP (Model Context Protocol) vulnerability in the AI Engine plugin, which is actively installed on more than 100,000 WordPress websites. This vulnerability can be exploited by authenticated attackers, with subscriber-level access and above, to get full access to the MCP and execute various commands like ‘wp_update_user’, allowing them to escalate their privileges to administrators by updating their user role. Please note that this vulnerability only critically affects users who have enabled the Dev Tools and then the MCP module in the settings, which is disabled by default.
Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on May 22, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on June 21, 2025.
We contacted Jordy Meow on May 21, 2025, and received a response within an hour. After providing full disclosure details, the developer released the patch on June 18, 2025. We would like to commend Jordy Meow for their prompt response and timely patch.
We urge users to update their sites with the latest patched version of AI Engine, version 2.8.4 at the time of this writing, as soon as possible.
On May 4th, 2025, we received a submission for a Privilege Escalation vulnerability in RealHomes, a WordPress theme with more than 33,000 sales. This vulnerability can be used by authenticated attackers, with subscriber-level access and above, to grant themselves administrative privileges by updating their user role. Please note that this vulnerability only critically affects users who have enabled the “Show user role option in profile” option in the settings, which is disabled by default.
Props to Thái An who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $585.00 for this discovery.
Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on May 12, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on June 11, 2025.
Wordfence contacted the InspiryThemes team on May 12, 2025, and received a response on May 15, 2025. After providing full disclosure details, the developer released the patch on May 26, 2025, and the second patch on June 5, 2025. We would like to commend the InspiryThemes team for their prompt response and timely patch.
We urge users to update their sites with the latest patched version of RealHomes, version 4.4.1 at the time of this writing, as soon as possible.
On March 24th, 2025, we received a submission for an Arbitrary File Upload and an Arbitrary File Deletion vulnerability in WP User Frontend Pro, a WordPress plugin with an estimated 9,000 active installations. The arbitrary file upload vulnerability can be used by authenticated attackers, with subscriber-level access and above, to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover. The arbitrary file deletion vulnerability can be used by authenticated attackers to delete arbitrary files, including the wp-config.php file, which can also make a site takeover possible.
Props to Foxyyy who discovered and responsibly reported these vulnerabilities through the Wordfence Bug Bounty Program. This researcher earned bounties of $273.00 and $142.00 for these discoveries.
All users of Wordfence – both free and paid – are protected against any exploits targeting these vulnerabilities by the Wordfence firewall’s built-in Malicious File Upload and Directory Traversal protections.
Wordfence contacted the weDevs team on March 31, 2025, and received a response on April 7, 2025. After providing full disclosure details, the developer released a patch on June 3, 2025.
We urge users to update their sites with the latest patched version of WP User Frontend Pro, version 4.1.4 at the time of this writing, as soon as possible.
The Wordfence Threat Intelligence team recently discovered an interesting malware variant that appears in the file system as a normal WordPress plugin containing a comment header, a handful of functions as well as a simple admin interface. Just like previous examples they have seen, this piece of malware contains code that ensures it remains hidden in the administrator dashboard. It has a password extraction feature, which requires configuration through its own admin interface, an AJAX-based remote code execution mechanism and unfinished code suggesting it is still in development.
This malware was first discovered by one of the Wordfence security analysts during a site clean on April 24, 2025. A malware signature detecting this and similar samples was released to our premium customers on May 6, 2025 after undergoing our Q&A process.
Customers using the free version of Wordfence will receive the same signature on June 5, 2025 after a 30 day delay. For added protection Wordfence released a firewall rule on May 15, 2025 to all paid Wordfence users, preventing remote code execution using the AJAX action. Site owners using the free version of the Wordfence plugin will receive the same firewall rule on June 14, 2025.
