Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ad Invalid Click Protector Plugin | ad-invalid-click-protector-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Blaze Widget Plugin | blaze-widget-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Britetechs Companion Plugin | britetechs-companion-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Contact Form 7 Multi Step Addon Plugin | contact-form-7-multi-step-addon-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Pods Plugin | pods-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Powerpress Plugin | powerpress-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Seo Optimized Images Plugin | seo-optimized-images-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Simply Show Hooks Plugin | simply-show-hooks-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Social Warfare Plugin | social-warfare-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Twenty20 Plugin | twenty20-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Wp Server Stats Plugin | wp-server-stats-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Wpcom Member Plugin | wpcom-member-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 | |
| Wrapper Link Elementor Plugin | wrapper-link-elementor-plugin-cve-2024-6297 | May 15, 2025 | Jun 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub