Subscribe
Share
Share
Embed
Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.
In this episode of Wordfence Security News, active exploitation targeting a critical
WooCommerce remote code execution flaw, Drupal attacks just days after patch release,
emergency Microsoft Defender updates, and more than 700 ghost CMS sites
compromised after attackers weaponized an AI discovered vulnerability.
This is Wordfence Security News, I'm Alex Thomas.
Attackers are actively targeting a critical, unauthenticated remote code execution vulnerability in WooCommerce Custom Product Add-ons Pro, a paid WooCommerce extension from AcoWebs with an estimated 21,000 active installations.
The plugin lets store owners build dynamic pricing rules and custom product fields, things like engraving fees, custom dimensions, or pay-what-you-want pricing.
Researcher Ren Voza reported the flaw through the Wordfence bug bounty program.
When exploited, it lets unauthenticated attackers run arbitrary code on the server
by submitting a specially crafted value to a WooCommerce add-to-cart request.
The root cause is that the plugin's custom pricing formula feature
passes user-controlled field values directly into PHP's eval function without sufficient sanitization.
The vulnerability affects all versions of the plugin through 5.4.1, and the vendor released a patched version, 5.4.2, on March 18th.
From the morning of May 23rd through the morning of May 27th, we observed a sharp rise in exploit attempts targeting this vulnerability.
The pattern is consistent with a focused campaign with the majority of activity coming from a single source IP.
Some payloads we're seeing in our data match the published proof of concept closely.
Site owners running WooCommerce Custom Product Add-Ons Pro should update to 5.4.2 immediately.
All Wordfence users are protected.
This week, Drupal patched a critical SQL injection vulnerability in Drupal Core,
which is currently under active exploitation.
The flaw allows unauthenticated remote attackers to conduct SQL injection attacks.
Drupal rates the vulnerability 23 out of 25 on their internal severity scale, and successful exploitation can lead to information disclosure, data tampering, privilege escalation, and in some configurations, remote code execution.
The vulnerability was discovered by Google Mandiant researcher Michael Maturi.
The flaw only affects Drupal sites configured with PostgreSQL as the database backend,
which Drupal estimates at under 5% of all installations.
That still translates to thousands of potentially vulnerable sites,
and Drupal is heavily used across government, higher education, media, and large enterprise environments.
Drupal pre-announced the vulnerability on May 18th with a public service announcement,
asked operators to reserve time during the May 20th release window,
and warned that exploits could appear within hours or days of patch publication.
The patch shipped on May 20th as scheduled.
By May 22nd, Drupal updated their advisory to confirm that
exploit attempts were being detected in the wild.
Imperva researchers tracked over 15,000 exploitation attempts,
targeting nearly 6,000 sites across 65 countries within 48 hours of patch release.
CISA added the vulnerability to its known exploited vulnerabilities catalog on May 22nd,
with a federal remediation deadline of May 27th.
Researchers at Miggo Security published an analysis on May 21st,
documenting that they built a working exploit for the vulnerability in under an hour
using Claude and less than $10 in API tokens.
Their team set Claude code to monitor the supported Drupal branches on the evening of May 20th,
then went to dinner.
By the time they returned, Claude had detected the patch,
identified the security commit, set up a vulnerable Drupal instance in a Docker container,
and with some human nudging per Miggo, constructed a proof of concept.
From patch publication, to working exploit was 51 minutes.
The first public proof of concept appeared on GitHub the next day.
Drupal sites using PostgreSQL should be patched now to the latest fixed release for their branch.
Continuing with active enterprise exploitation,
Microsoft also rushed emergency out-of-band Defender updates this week
for two zero days already being exploited in the wild.
The first is a local privilege escalation flaw in the Microsoft Malware Protection Engine that lets an attacker gain system-level control on a Windows machine.
The second is a denial-of-service flaw in the Defender Anti-Malware platform that can let a standard user block Defender Definition updates.
Both vulnerabilities are linked to a security researcher who goes by the handle Chaotic Eclipse, or Nightmare Eclipse, who published proof-of-concept exploits publicly in April without coordinated disclosure, citing a dispute with Microsoft Security Response Center over how earlier vulnerability reports had been handled.
The researcher named the exploits Red Sun and Undefend.
They are part of a three-exploit set that also includes BlueHammer, which Microsoft patched in April, after that one was also exploited in the wild.
Researchers at Huntress documented real-world use of the Nightmare Eclipse tooling in mid-April.
In one customer intrusion, the activity appeared to begin with compromised FortiGate SSL VPN access, followed by hands-on keyboard reconnaissance and use of BlueHammer, RedSun, and Undefend tooling.
Vector Networks described the combined attack as a layered degradation strategy.
The attacker uses BlueHammer or Red Sun to gain system-level access, then deploys Undefend to progressively weaken endpoint protection by blocking Defender's signature updates.
CISA added both vulnerabilities to its known Exploited Vulnerabilities catalog on May 20th with a June 3rd federal patch deadline.
The fix is specifically in Microsoft Defender Anti-Malware Platform version 4.18.26040.7
and Malware Protection Engine version 1.1.26040.8.
Microsoft also addressed a third Defender vulnerability, a heap-based buffer overflow
that could enable remote code execution without user interaction.
That one has not been confirmed exploited in the wild.
Defender updates usually deploy automatically, but we suggest ensuring the patched versions are installed.
Check the Malware Protection Engine version and Anti-Malware Platform version on any critical Windows systems, especially anywhere update policies might delay deployment.
In another active exploitation campaign, more than 700 Ghost CMS sites have now been compromised in a ClickFix campaign,
including sites associated with Harvard University, Oxford University, Auburn University, and DuckDuckGo.
The exploited vulnerability is a critical SQL injection flaw.
It affects Ghost CMS versions 3.24.0 through 6.19.0,
and was patched in February 2026 in version 6.19.1.
Nicholas Carlini at Anthropic pointed Claude at Ghost during testing of Claude Opus 4.6,
having picked Ghost specifically because it had a strong security track record
and reportedly had never had a critical vulnerability in its history.
90 minutes later, Claude had identified a blind SQL injection in Ghost's content API
and used it to pull the admin API key out of the database.
Anthropic disclosed it to Ghost on February 16th, and Ghost published a fix within days.
Researchers at Shenshin XLAB first detected attackers exploiting this vulnerability in early May, and the attack works in stages.
First, an unauthenticated attacker sends a crafted request to Ghost's public content API.
The SQL injection extracts the site's admin API key from the database.
That key, normally restricted to administrators, lets the attacker call Ghost's legitimate admin API and modify article content directly without having to touch the admin panel.
From there, the attackers inject a malicious JavaScript loader into the bottom of articles across the compromised site.
When a real user visits one of those pages, a cloaking script filters out bots and security researchers and redirects everyone else to a fake Cloudflare verification page.
The page tells the visitor to press the Win key plus R on their keyboard, paste a command, and hit Enter.
That is a click-fix attack, and the command silently installs malware.
A DLL file in the malware payload carries a compilation timestamp of February 16th,
the same day Anthropic reported the vulnerability to Ghost.
That suggests the campaign preparation began very early,
though the public mass exploitation wave was not detected until May.
Ghost operators should update to 6.19.1 or later, rotate admin API keys, and audit article content for injected JavaScript.
Researchers at Socket published an analysis of a new cross-ecosystem supply chain campaign they call Trapdoor.
The campaign began on May 22nd and spread across NPM, PyPI, and Crates.io with more than 34 malicious packages and over 384 versions and artifacts.
The package names were designed to look useful to Crypto, DeFi, Solana, and AI developers with names like Prompt Engineering Toolkit, Solidity, Deploy Guard, and DeFi Threat Scanner.
Once installed, the packages steal the kind of secrets developers usually have on their machines.
SSH keys, AWS credentials, GitHub tokens, browser data, crypto wallet data, and environment variables.
The mechanics differ by ecosystem, but the goal is the same.
Get code running during install, import, or build, then exfiltrate everything that is useful.
Trapdoor also targets AI coding assistants directly.
The malicious packages plant hidden instructions inside files like claude.md and .cursorrules.
Those files are normally used to give tools like Claude Code and Cursor project-specific guidance.
In this case, the instructions are hidden with invisible Unicode characters.
A developer may not see them when reading the file, but the AI assistant can still process them as text.
Socket describes the result as a fake security scan that is really a credential exfiltration routine.
Socket also found the same actor opening pull requests against high-profile AI and developer projects,
trying to add these poisoned instruction files under harmless-looking titles.
If you work in any of the targeted ecosystems, you should audit recent package installs,
inspect claude.md and .cursorules files for hidden Unicode characters,
and rotate any credentials that might have been exposed.
Finally, Checkpoint is tracking new campaigns from Nimbus Manticore, an Iranian state-aligned threat actor.
The group has run three campaign waves since late February,
with recent lures impersonating aviation and software organizations across the United States, Europe, and the Middle East.
Checkpoint notes the group's broader long-running focus includes defense, aviation, and telecommunications.
The campaigns coincide with Operation Epic Fury, the military campaign against Iran that began February 28th.
Checkpoint identified a new backdoor in the campaign called Minifast.
It's a 64-bit Windows DLL that impersonates Chrome in its network traffic and gives the attacker persistent remote access, shell execution, file upload and download, process control, and directory enumeration.
Checkpoint assesses that many fast likely involved AI-assisted development based on stylistic indicators in the code.
The three campaign waves used different delivery methods.
The February wave used career-themed phishing emails carrying zip archives targeting aviation and software organizations in Saudi Arabia and Australia.
The March wave used trojanized Zoom installers delivered through fake meeting invitations.
and the April Wave used search engine poisoning with a fake Oracle SQL Developer download page
hosted at GetSQLDeveloper.com, supported by dozens of related domains designed to boost its search
reputation. Links to all the stories we covered today are in the description.
Thanks for watching or listening, and we'll see you next week on Wordfence Security News.