Wordfence : Massive wave of attacks
Wordfence researchers spotted a massive wave of attacks in the days that are targeting over 1.6 million WordPress sites from 16,000 IPs.
“Today, on December 9, 2021, our Threat Intelligence team noticed a drastic uptick in attacks targeting vulnerabilities that make it possible for attackers to update arbitrary options on vulnerable sites. This led us into an investigation which uncovered an active attack targeting over a million WordPress sites.” reads the post published by Wordfence. “Over the past 36 hours, the Wordfence network has blocked over 13.7 million attacks targeting four different plugins and several Epsilon Framework themes across over 1.6 million sites and originating from over 16,000 different IP addresses.”
The attacks are originating from 16,000 IP addresses and are targeting four WordPress plugins and fifteen Epsilon Framework themes.
The affected plugins:
PublishPress Capabilities <= 2.3Kiwi Social Plugin <= 2.0.10Pinterest Automatic <= 4.14.3WordPress Automatic <= 3.53.2while the targeted Epsilon Framework themes are:
Shapely <=1.2.8NewsMag <=2.4.1Activello <=1.4.1Illdy <=2.1.6Allegiant <=1.2.5Newspaper X <=1.3.1Pixova Lite <=2.0.6Brilliance <=1.2.9MedZone Lite <=1.2.5Regina Lite <=2.0.5Transcend <=1.1.9Affluent <1.1.0Bonkers <=1.0.5Antreas <=1.0.6NatureMag Lite – No patch known. Recommended to uninstall from site.Below are the top 10 offending IPs observed:
184.108.40.206 with 430,067 attacks blocked.220.127.116.11 with 277,111 attacks blocked.18.104.22.168 with 274,574 attacks blocked.22.214.171.124 with 216,888 attacks blocked.126.96.36.199 with 205,143 attacks blocked.188.8.131.52 with 194,979 attacks blocked.184.108.40.206 with 192,778 attacks blocked.220.127.116.11 with 181,508 attacks blocked.18.104.22.168 with 158,873 attacks blocked.22.214.171.124 with 153,350 attacks blocked.Experts noticed that in most cases, the threat actors are enabling the users_can_register option and setting the default_role option to administrator. Then the attackers are able to register on any site as an administrator and take over the site.
Site admins could determine if their site has been compromised by reviewing the user accounts on the site to determine if there are any unauthorized user accounts. Indicators of compromise include the presence of a vulnerable version of any of the above plugins or themes along with the presence of a rogue user account.
Researchers recommend removing any rogue accounts and updating your plugins and themes as soon as possible
Experts also recommend reviewing the settings in http://examplesite[.]com/wp-admin/options-general.php page focusing on Membership` and `New User Default Role` settings.
“We strongly recommend ensuring that all of your sites have been updated to the patched versions of the plugins and themes.”
The post 1.6 million WordPress sites targeted in the last couple of days appeared first on Security Affairs.