WordPress Security Alert: Hacker posing as official sends warning about malicious patch links

Article Description:

Recently, security firm Wordfence disclosed that hackers have been posing asWordPressOfficial identities are sending malicious patch links to webmasters via phishing emails. The email claims to have discovered a website vulnerability (CVE-2023-45124) and advises the webmaster to immediately use the link to fix the vulnerability.

However, the links actually lead to phishing websites set up by the hackers themselves. If the victim clicks on the links without verifying the authenticity of the emails, he or she will be directed to a WordPress torrents website called “en-gb-wordpress [...] org”.

According to the official press release, once a victim installs the so-called “phishing patch,” the malware adds a hidden malicious administrator account “wpsecuritypatch” to the backend of the website and transmits the website's URL and password back to the hacker's server. The malware will add a hidden malicious administrator account “wpsecuritypatch” to the backend of the website and transmit the website URL and password back to the hacker's server. Next, the hacker will implant a backdoor program "wpgate [.] zip" in the website to maintain control of the victim's website.

Security researchers found that in an effort to increase trust, the hackers posted multiple fake comments in the comments section of the phishing site and listed some of the programmers at WordPress security firm Automattic as developers.

In response to this security threat, webmasters are advised to always verify any emails and links from WordPress officials with caution. In case of a similar situation, they should visit the official WordPress website directly for security advice, as well as strengthen their website's security configuration and monitoring measures to prevent similar malicious attacks from occurring.