Hackers Exploit Outdated WordPress Plugin to Backdoor Thousands of WordPress Sites

April 24, 2023IRavie LakshmananServer Security / WordPress

Threat actors have been observed using a legitimate but outdated WordPress plugin for backdoor websites surreptitiously as part of an ongoing campaign, Sucuri revealed in a report published last week.

The plugin in question is Eval PHP, published by a developer called flashpixx. It allows users to embed PHP code pages and posts from WordPress sites that are executed whenever the posts are opened in a web browser.

Although Eval PHP has never received an update in 11 years, statistics compiled by WordPress show that it is installed on more than 8,000 websites, with the number of downloads jumping by one or two on average from September 2022 to 6,988 on March 30, 2023.

On April 23, 2023 alone, it was downloaded 2,140 times. The plugin has accumulated 23,110 downloads over the past seven days.

GoDaddy-owned Sucuri said it observed some infected website databases injected with malicious code into the “wp_posts” table, which stores a site’s posts, pages and navigation menu information. The requests originate from three different IP addresses based in Russia.

“This code is quite simple: it uses the file_put_contents function to create a PHP script in the website’s docroot with the specified remote code execution backdoor,” said security researcher Ben Martin.

“Although the injection in question drops a conventional backdoor into the file structure, the combination of a legitimate plugin and a backdoor dropper in a WordPress post allows them to easily reinfect the website and remain hidden. All the attacker has to do is visit it. one of the infected posts or pages and the backdoor will be injected into the file structure.”

Sucuri said it detected more than 6,000 instances of this backdoor on compromised websites in the last 6 months, and described the pattern of inserting the malware directly into the database as an “interesting new development “.

The attack chain involves installing the Eval PHP plugin on compromised sites and abusing it to establish persistent backdoors in various posts that are sometimes also saved as drafts.

“The way the Eval PHP plugin works is enough to save a page as a draft to run the PHP code inside the [evalphp] shortcodes,” Martin explained, adding that the rogue pages are created with a real site administrator as the author, suggesting the attackers were able to successfully log in as a privileged user.

The development once again points to how malicious actors are experimenting with different methods to maintain their position in compromised environments and evade server scans and file integrity checks.

Site owners are advised to secure their WP admin panel and monitor any suspicious logins to prevent threat actors from gaining admin access and installing the plugin.

WordPress removes PHP Exploited Eval plugin

The WordPress team has stepped in to remove the derelict Eval PHP plugin from the repository following a report from Sucuri that it was being abused by threat actors to inject malicious backdoors into thousands of websites.

“This plugin was closed on April 26, 2023 and is no longer available for download,” reads a banner message. “This closure is permanent.”