Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ad Invalid Click Protector Plugin | — | Update ad-invalid-click-protector plugin to version 1.2.11, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Blaze Widget Plugin | — | Update blaze-widget plugin to version 2.5.4, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Britetechs Companion Plugin | — | Update britetechs-companion plugin to version 2.2.8, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Contact Form 7 Multi Step Addon Plugin | — | Update contact-form-7-multi-step-addon plugin to version 1.0.7, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Pods Plugin | — | Update pods plugin to version 3.2.4, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Powerpress Plugin | — | Update powerpress plugin to version 11.9.6, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Seo Optimized Images Plugin | — | Update seo-optimized-images plugin to version 2.1.4, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Simply Show Hooks Plugin | — | Update simply-show-hooks plugin to version 1.2.1, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Social Warfare Plugin | — | Update social-warfare plugin to version 4.4.7.3, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Twenty20 Plugin | — | Update twenty20 plugin to version 1.6.4, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Wp Server Stats Plugin | — | Update wp-server-stats plugin to version 1.7.8, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Wpcom Member Plugin | — | Update wpcom-member plugin to version 1.3.14, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
| Wrapper Link Elementor Plugin | — | Update wrapper-link-elementor plugin to version 1.0.5, or a newer patched version | May 15, 2025 | Jun 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub