WordPress AccessPress Plugins and Themes Backdoor

Fortify Security Team
Jan 21, 2022

A backdoor has been discovered in WordPress AccessPress plugins and themes, which could allow an attacker access to a targeted website. AccessPress plugins and themes are used to provide website functionality and design options to website administrators. Successful exploitation of this backdoor could allow an attacker to redirect users to malicious sites as well as access to the vulnerable website.

THREAT INTELLIGENCE: There are currently reports of websites redirecting users to malicious sites.

The references for this state that malicious actors have been compromising affected sites with backdoors as far back as September 2021.

SYSTEMS AFFECTED:

  • accesspress-anonymous-post 2.8.0
  • accesspress-custom-css 2.0.1
  • accesspress-custom-post-type 1.0.8
  • accesspress-facebook-auto-post 2.1.3
  • accesspress-instagram-feed  4.0.3
  • accesspress-pinterest 3.3.3
  • accesspress-social-counter 1.9.1
  • accesspress-social-icons 1.8.2
  • accesspress-social-login-lite 3.4.7
  • accesspress-social-share 4.5.5
  • accesspress-twitter-auto-post 1.4.5
  • accesspress-twitter-feed 1.6.7
  • ak-menu-icons-lite 1.0.9
  • ap-companion 1.0.7
  • ap-contact-form 1.0.6
  • ap-custom-testimonial 1.4.6
  • ap-mega-menu 3.0.5
  • ap-pricing-tables-lite 1.1.2
  • apex-notification-bar-lite 2.0.4
  • cf7-store-to-db-lite 1.0.9
  • comments-disable-accesspress 1.0.7
  • easy-side-tab-cta 1.0.7
  • everest-admin-theme-lite 1.0.7
  • everest-coming-soon-lite 1.1.0
  • everest-comment-rating-lite 2.0.4
  • everest-counter-lite 2.0.7
  • everest-faq-manager-lite 1.0.8
  • everest-gallery-lite 1.0.8
  • everest-google-places-reviews-lite 1.0.9
  • everest-review-lite 1.0.7
  • everest-tab-lite 2.0.3
  • everest-timeline-lite 1.1.1
  • inline-call-to-action-builder-lit 1.1.0
  • product-slider-for-woocommerce-lite 1.1.5
  • smart-logo-showcase-lite 1.1.7
  • smart-scroll-posts 2.0.8
  • smart-scroll-to-top-lite 1.0.3
  • total-gdpr-compliance-lite 1.0.4
  • total-team-lite 1.1.1
  • ultimate-author-box-lite 1.1.2
  • ultimate-form-builder-lite 1.5.0
  • woo-badge-designer-lite 1.1.0
  • wp-1-slider 1.2.9
  • wp-blog-manager-lite  1.1.0
  • wp-comment-designer-lite 2.0.3
  • wp-cookie-user-info 1.0.7
  • wp-facebook-review-showcase-lite 1.0.9
  • wp-fb-messenger-button-lite 2.0.7
  • wp-floating-menu 1.4.4
  • wp-media-manager-lite 1.1.2
  • wp-popup-banners 1.2.3
  • wp-popup-lite 1.0.8
  • wp-product-gallery-lite 1.1.1
  • accessbuddy  1.0.0
  • accesspress-basic 3.2.1
  • accesspress-lite 2.92
  • accesspress-mag 2.6.5
  • accesspress-parallax  4.5
  • accesspress-ray 1.19.5
  • accesspress-root 2.5
  • accesspress-staple 1.9.1
  • accesspress-store 2.4.9
  • agency-lite 1.1.6
  • aplite 1.0.6
  • bingle 1.0.4
  • bloger 1.2.6
  • construction-lite 1.2.5
  • doko 1.0.27
  • enlighten 1.3.5
  • fashstore 1.2.1
  • fotography 2.4.0
  • gaga-corp 1.0.8
  • gaga-lite 1.4.2
  • one-paze 2.2.8
  • parallax-blog 3.1.1574941215
  • parallaxsome 1.3.6
  • punte 1.1.2
  • revolve 1.3.1
  • ripple 1.2.0
  • scrollme 2.1.0
  • sportsmag 1.2.1
  • storevilla 1.4.1
  • swing-lite 1.1.9
  • the-launcher 1.3.2
  • the-Monday 1.4.1
  • uncode-lite 1.3.1
  • unicon-lite 1.2.6
  • vmag 1.2.7
  • vmagazine-lite 1.3.5
  • vmagazine-news 1.0.5
  • zigcy-baby 1.0.6
  • zigcy-cosmetics 1.0.5
  • zigcy-lite 2.0.9

 

RISK:

Government:

  • Large and medium government entities: High
  • Small government entities: Medium

Businesses:

  • Large and medium business entities: High
  • Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:

A backdoor has been discovered in WordPress AccessPress plugins and themes, which could allow an attacker access to a targeted website. When the compromised plugin or theme is installed, a payload is deployed that creates a webshell into “./wp-includes/vars.php” and then hides its tracks by deleting its files.  When successfully installed, the backdoor gives the threat actor control over the infected website.

RECOMMENDATIONS: We recommend the following actions be taken:

  • Consult the list of affected themes and plugins provided in the Systems Affected section above and verify if you are utilizing any of them in your environment.
  • Update all affected plugins and themes to their newest safe version, published by AccessPress.
  • If an affected plugin or theme was found to be in use, check all web sites and servers for signs of potential compromise.
  • BleepingComputer provided an extensive list of checks that can be used to determine if a site may have been compromised. Information can be found at the reference below in the “Am I affected?” section near the bottom of the article.

REFERENCES:

CVE:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24867

Jetpack:

https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/

BleepingComputer:

https://www.bleepingcomputer.com/news/security/over-90-wordpress-themes-plugins-backdoored-in-supply-chain-attack/

Sucuri Blog:

https://blog.sucuri.net/2022/01/accesspress-themes-hit-with-targeted-supply-chain-attack.html

Recent Posts

Mozilla Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Mozilla Firefox and Mozilla Thunderbird, the most severe of which could allow for arbitrary code execution. Mozilla Firefox is a web browser used to access the Internet. Mozilla Firefox ESR is a version of the web...

Apple Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Apple Products, the most severe of which could allow for arbitrary code execution. macOS Ventura is the 19th and current major release of macOS iOS is a mobile operating system for mobile devices, including the iPhone,...

Citrix ADC and Gateway Could Allow for Authentication Bypass

Multiple vulnerabilities have been discovered in Citrix ADC and Gateway, the most severe of which could allow for Authentication Bypass. Citrix ADC and Gateway is an Application Delivery Controller and a gateway service to products respectively. Successful...