Subscribe
Share
Share
Embed
Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.
This week on Wordfence Security News, backdoor WordPress plugin updates that steal passwords
and the two-factor secrets meant to stop them, marketing plugins on more than a million sites
hijacked to serve a tampered script, an Oracle PeopleSoft ZeroDay mass exploited by an extortion
crew hitting university's hardest, a maximum severity Ivanti flaw that hands attackers root,
a popular AI app builder with a high severity flaw now under active attack,
and forum software where one request and a username takes over any account.
This is Wordfence Security News. I'm Alex Thomas.
Our top story is a supply chain compromise at ShapedPlugin,
a WordPress plugin vendor whose free plugins run on more than 400,000 sites.
Attackers broke into the vendor's update system and slipped a backdoor into the paid pro versions of its plugins delivered straight through the vendor's official license update channels.
Now, supply chain compromises work because of those last four words.
The site owners who got hit did everything right.
They bought legitimate licenses, they installed updates through the official channels, and they got a backdoor anyway.
Our investigation found that the attacker had access to both ShapedPlugin's free WordPress.org plugins and its paid pro update system.
But the malware showed up only in the paid builds.
That gave the attacker a quieter exploitation path.
WordPress.org now delays plugin and theme auto updates for up to 24 hours so changes can be reviewed before they roll out broadly.
A commercial pro-update channel may not have that same public review window, and paying customers may be higher-value targets.
This was not random poisoning of the biggest download path.
It was a deliberate use of a trusted commercial update channel.
And this is not a one-off.
This spring, one researcher alone, Austin Ginder at Anchor Hosting, disclosed four backdoored WordPress plugins in a single month.
The biggest was the Essential Plugin Portfolio, more than 20 plugins that a buyer picked up on a marketplace and quietly poisoned.
Around the same time, Smart Slider 3 Pro was compromised through the vendor's own update server.
Add in last episode's miasma worm against Microsoft's GitHub, plus the constant drip of NPM and PyPI attacks, and the same move keeps showing up.
Instead of just hunting for bugs in the code, attackers are taking over the update pipeline itself.
WordPress vendors are squarely on the target list, and ShapedPlugin is just one of the latest.
The ShapedPlugin backdoor is built to stay invisible and steal. It hides itself from the
plugin list, captures every login in plain text, and opens several secret doors for the attacker
to come back through. On top of that, it doesn't just steal passwords, it also steals two-factor
authentication secrets. And that changes the typical cleanup scenario. The attackers didn't
need a password to get in that came through a back door.
But once inside, the malware harvests real logins and the 2FA seeds that go with them.
That hands the attacker another way in.
Login is a real user, bypass two-factor authentication, and it looks like a normal sign-in.
So cleanup isn't just removing the malware.
It's rotating every password and every two-factor secret because each is a separate compromise
and closing one leaves the others open.
We confirmed this compromise after a customer's site was hit by a backdoor update, and it was reported to us on June 12th.
But Wordfence customers had protection well before this was public.
Our malware detection has flagged this backdoor family since April 18th, and after confirming the ShapedPlugin Compromise, we released additional signatures between May 12th and May 21st.
Premium, Care, Response, and paid Wordfence CLI customers received those immediately.
Free users received the same detection on the standard 30-day delay.
Now, there's one important thing we want to note.
Don't rely on the version number alone.
WPScan lists Real Testimonials Pro 3.2.5 as fixed,
but on June 12th, we downloaded that same version directly
from ShapedPlugin's official update endpoint and confirmed it was still backdoored.
So if you run any ShapedPlugin Pro plugin, treat your site as potentially compromised.
Scan the files on disk with Wordfence or Wordfence CLI and check for the indicators in our write-up.
Rotate every credential the malware could have grabbed, admin passwords, database credentials, and the secret keys and API tokens in your WP config file.
Revoke and regenerate your two-factor secrets and check your administrator accounts for anyone you don't recognize.
We notified ShapedPlugin on June 15th, and they confirmed they are investigating and preparing updated plugin releases after additional security review and validation.
As of this recording, those verified updates had not yet been released.
The full technical write-up with indicators of compromise is on the Wordfence blog.
We've got another WordPress supply chain compromise this week, a different method, same goal.
This one hit OptinMonster, TrustPulse, and PushEngage, three popular marketing plugins owned by the same company, AwesomeMotive, that together run on more than 1.2 million sites.
For a short window, those plugins served a tampered script straight to the sites using them.
This one works differently from the ShapedPlugin attack.
These plugins don't just run code that ships inside the plugin.
They also pull a JavaScript file from the vendor's own servers over a content delivery network every time a page loads.
On June 12th, an attacker swapped that file for a malicious one, so sites loaded the poison script automatically from a source they were built to trust.
According to AwesomeMotive, the attackers used the critical UpdraftPlus remote code execution flaw we covered last episode to compromise a separate marketing website server.
From there, they found the key to AwesomeMotive's content delivery network and used it to tamper with the script served to customer sites.
SanSec discovered and analyzed the tampered scripts, and AwesomeMotive later confirmed the breach and root cause.
This is the kind of real-world fallout we flagged last week.
The tampered script was selective. It only acted if a site administrator was logged in when the page loaded.
When that happened, it created a hidden administrator account, installed a concealed backdoor plugin that handed the attacker a webshell,
and sent credentials off to a domain the attacker controlled.
From there, they gained full control of the site.
And this wasn't opportunistic.
That exfiltration domain was registered back on April 28th, roughly six weeks before the
attack, a sign the operation was planned well in advance.
The exposure window was short.
OptinMonster and TrustPulse were affected only briefly on June 12th, with PushEngage
running longer into June 14th.
And the script only fired for logged-in admins.
so far fewer sites were actually hit than the 1.2 million that run these plugins.
AwesomeMotive says its own application servers and customer data were not touched,
but any site that got caught should be treated as fully compromised.
If you run OptinMonster, TrustPulse, or PushEngage,
and an administrator was logged into your dashboard around June 12th,
check your site directly.
Look on the server itself, not the plugin dashboard.
for plugins you don't recognize and admin accounts you didn't create.
SanSec disclosed the campaign on June 13th,
and AwesomeMotive published incident notices late June 14th or early June 15th UTC.
Our top enterprise story is a critical zero-day in Oracle PeopleSoft
that's been under active attack for weeks by the extortion group ShinyHunters.
The vulnerability lets an unauthenticated attacker run code on the server
by sending a web request and doesn't require a login or user interaction.
PeopleSoft is the software a lot of large organizations run their HR, payroll, finance,
and student records on. Universities, government agencies, big employers. The flaw is in a
component PeopleSoft uses to manage its own updates, and it's reachable over the network
without authenticating. So an attacker who can reach the server can take it over outright.
Google's Mandiant team, which tracks the group as UNC-6240, says ShinyHunters exploited this as a zero-day between May 27th and June 9th, before Oracle put out an emergency advisory on June 10th.
ShinyHunters is a data theft and extortion crew.
You may recognize the name from last year's Salesforce data theft campaigns, as well as previous episodes of Wordfence Security News.
The threat group leveraged this vulnerability to install custom remote management agents, masquerading as legitimate cloud endpoints to hold their access, then ran scripts to spread across the network and extract data.
The scale of this attack is significant.
Mandiant notified more than 100 organizations of potential exposure across roughly 300 PeopleSoft systems.
68% of the targets were in higher education, most of them US-based.
One confirmed victim is the University of Nottingham in the UK, where attackers leaked data tied to roughly 450,000 current and former students, including contact information.
And true to their pattern, ShinyHunters is demanding a payment to keep the stolen data private and posting it to leak sites when they don't get paid.
Oracle's June 10th advisory came out of band outside its normal quarterly patch cycle, which is a signal of how serious this is.
The affected versions are PeopleTools 8.61 and 8.62 and older.
Unsupported versions are likely vulnerable too.
The patch sits between Oracle's support login and the advisory leans heavily on mitigations.
If you run PeopleSoft, apply Oracle's guidance now.
And if your system was reachable from the internet, treat it as potentially compromised.
You should hunt for those rogue remote management agents and any administrator accounts you didn't create.
Our second enterprise story is a maximum severity flaw in Ivanti Sentry.
It's an OS command injection bug that lets an attacker run code on the appliance's root.
Ivanti Sentry, formerly MobileIron Sentry, is a gateway appliance that sits between a company's backend systems and its employees' mobile devices.
It's a kind of edge-facing box where an exposed management interface can become a critical risk fast,
so a root-level code execution flaw on it is about as bad as it gets.
Ivanti disclosed fixes on June 9th in versions R10.5.2, R10.6.2, and R10.7.1,
alongside a second critical flaw, an authentication bypass that lets an unauthenticated attacker create their own administrator account.
Now, Ivanti says it hasn't seen any confirmed customer compromises, but it has already seen exploitation attempts hitting its honeypots, which are decoy systems set up to catch exactly this kind of probing.
watchTowr published technical details on June 10th, and CISA treated the flaw as urgent.
It added the vulnerability to its Known Exploited Vulnerabilities catalog on June 11th, with an unusually short June 14th deadline for federal agencies, a deadline that's already passed.
So the public timeline compressed from vendor advisory to active exploitation priority in about two days.
If you run Ivanti Sentry, update to one of the fixed versions right away and make sure management interfaces are not exposed to the public internet.
We keep coming back to this theme on the show and its attackers targeting the tools developers use to build AI.
The latest is Langflow, an open source platform for building AI apps and agents by dragging and dropping components together.
It's one of the most popular projects of its kind, roughly 149K stars on GitHub, and a high severity flaw in it is now being actively exploited.
The bug lets an attacker upload a file and break out of the folder it's supposed to land in, dropping their own file anywhere on the server, and from there, running their own code.
What makes it even worse, out of the box, Langflow logs users in automatically with no password.
So on a default install, an attacker doesn't need an account or credentials of any kind.
They just need to be able to reach the server.
Now, this flaw isn't new.
Tenable, the firm that found it, disclosed it back on March 27th.
The Langflow application fix is in version 1.9.0, released in mid-April.
But months later, attackers are going after exposed deployments that never updated.
The security firm VulnCheck caught them dropping test files on exposed servers this month,
checking which ones are still vulnerable, and then added the flaw to its Known Exploited Vulnerabilities.
Historical scans over the past year found roughly 7,000 Langflow instances sitting on the open internet,
though that may not reflect the number exposed today.
This seems to keep happening to AI development tools.
A couple of episodes back, we covered a similar takeover flaw in Flowise, another drag-and-drop AI builder.
These platforms are powerful, they're being adopted fast, and they often get stood up on a server and forgotten, which is exactly the kind of target attackers look for.
If you run Langflow, update to the latest version and don't leave it facing the internet.
At a minimum, turn off that automatic login so it actually requires a password.
phpBB is one of the most widely used freeform platforms on the web, the software behind a huge number of community message boards.
And it just patched a critical flaw that lets an attacker take over any account on a forum,
including an administrator's, with a single web request and no password.
The only thing the attacker needs is the target's username,
and on most forums that's not a secret, since member lists are public by default.
With a username and one unauthenticated request,
the attacker gets a valid login session as that user.
If that user is an admin, they've got full control of the forum.
The researcher who found it, Dan Stefan Alexandru at Pentest Tools, actually reported a pair of flaws.
The second one involves phpBB's optional feature for logging in through an outside account,
think sign-in with Google, and only affects forums that turn it on.
Both were fixed in phpBB version 3.3.17, released June 6th.
As of this recording, we haven't seen confirmed exploitation or public exploit code,
But given how simple the main flaw is and that the details are now public, that probably won't last.
So if you run phpBB forum, update to 3.3.17.
For the main bypass, that upgrade is the only complete fix.
There's no setting that mitigates it.
If you can't update right away and you use that outside login feature,
you can switch it off as a stopgap for the second flaw.
But we urge you to update to get complete protection.
Links to all the stories we covered today are in the description.
Thanks for watching or listening, and we'll see you next week on Wordfence Security News.