Vulnerability · Published Jun 25, 2024 · Assigned by Wordfence
CVE-2024-6297Several WordPress.org Plugins <= Various Versions - Injected Backdoor
Critical 10.0
In plain English
A critical-severity security flaw in BLAZE Retail Widget from blazeretail. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| warfareplugins | Social Sharing Plugin – Social Warfare | 4.4.6.4 – through 4.4.7.1 |
| themerex | Contact Form 7 Multi-Step Addon | 1.0.4 – through 1.0.5 |
| stuartobrien | Simply Show Hooks | 1.2.1 – through 1.2.2 |
| pedrogusmao02 | Wrapper Link Elementor | 1.0.2 – through 1.0.3 |
| blazeretail | BLAZE Retail Widget | 2.2.5 – through 2.5.2 |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/56d24bc8-4a1a-4e60-aec5-960703a6058a?source=cve
- https://wordpress.org/support/topic/a-security-message-from-the-plugin-review-team/
- https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.6.4/trunk/social-warfare.php#L54
- https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.6.4/trunk/social-warfare.php#L583
- https://plugins.trac.wordpress.org/changeset/3105893/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106042%40social-warfare&new=3106042%40social-warfare&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/browser/simply-show-hooks/trunk/index.php
- https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-addon/trunk/trx-contact-form-7-multi-step-addon.php
- https://plugins.trac.wordpress.org/browser/wrapper-link-elementor/trunk/wrapper.php?rev=3106508
- https://plugins.trac.wordpress.org/browser/blaze-widget/trunk/blaze_widget.php