WordPress AccessPress Plugins and Themes Backdoor

Fortify Security Team
Jan 21, 2022

A backdoor has been discovered in WordPress AccessPress plugins and themes, which could allow an attacker access to a targeted website. AccessPress plugins and themes are used to provide website functionality and design options to website administrators. Successful exploitation of this backdoor could allow an attacker to redirect users to malicious sites as well as access to the vulnerable website.

THREAT INTELLIGENCE: There are currently reports of websites redirecting users to malicious sites.

The references for this state that malicious actors have been compromising affected sites with backdoors as far back as September 2021.

SYSTEMS AFFECTED:

  • accesspress-anonymous-post 2.8.0
  • accesspress-custom-css 2.0.1
  • accesspress-custom-post-type 1.0.8
  • accesspress-facebook-auto-post 2.1.3
  • accesspress-instagram-feed  4.0.3
  • accesspress-pinterest 3.3.3
  • accesspress-social-counter 1.9.1
  • accesspress-social-icons 1.8.2
  • accesspress-social-login-lite 3.4.7
  • accesspress-social-share 4.5.5
  • accesspress-twitter-auto-post 1.4.5
  • accesspress-twitter-feed 1.6.7
  • ak-menu-icons-lite 1.0.9
  • ap-companion 1.0.7
  • ap-contact-form 1.0.6
  • ap-custom-testimonial 1.4.6
  • ap-mega-menu 3.0.5
  • ap-pricing-tables-lite 1.1.2
  • apex-notification-bar-lite 2.0.4
  • cf7-store-to-db-lite 1.0.9
  • comments-disable-accesspress 1.0.7
  • easy-side-tab-cta 1.0.7
  • everest-admin-theme-lite 1.0.7
  • everest-coming-soon-lite 1.1.0
  • everest-comment-rating-lite 2.0.4
  • everest-counter-lite 2.0.7
  • everest-faq-manager-lite 1.0.8
  • everest-gallery-lite 1.0.8
  • everest-google-places-reviews-lite 1.0.9
  • everest-review-lite 1.0.7
  • everest-tab-lite 2.0.3
  • everest-timeline-lite 1.1.1
  • inline-call-to-action-builder-lit 1.1.0
  • product-slider-for-woocommerce-lite 1.1.5
  • smart-logo-showcase-lite 1.1.7
  • smart-scroll-posts 2.0.8
  • smart-scroll-to-top-lite 1.0.3
  • total-gdpr-compliance-lite 1.0.4
  • total-team-lite 1.1.1
  • ultimate-author-box-lite 1.1.2
  • ultimate-form-builder-lite 1.5.0
  • woo-badge-designer-lite 1.1.0
  • wp-1-slider 1.2.9
  • wp-blog-manager-lite  1.1.0
  • wp-comment-designer-lite 2.0.3
  • wp-cookie-user-info 1.0.7
  • wp-facebook-review-showcase-lite 1.0.9
  • wp-fb-messenger-button-lite 2.0.7
  • wp-floating-menu 1.4.4
  • wp-media-manager-lite 1.1.2
  • wp-popup-banners 1.2.3
  • wp-popup-lite 1.0.8
  • wp-product-gallery-lite 1.1.1
  • accessbuddy  1.0.0
  • accesspress-basic 3.2.1
  • accesspress-lite 2.92
  • accesspress-mag 2.6.5
  • accesspress-parallax  4.5
  • accesspress-ray 1.19.5
  • accesspress-root 2.5
  • accesspress-staple 1.9.1
  • accesspress-store 2.4.9
  • agency-lite 1.1.6
  • aplite 1.0.6
  • bingle 1.0.4
  • bloger 1.2.6
  • construction-lite 1.2.5
  • doko 1.0.27
  • enlighten 1.3.5
  • fashstore 1.2.1
  • fotography 2.4.0
  • gaga-corp 1.0.8
  • gaga-lite 1.4.2
  • one-paze 2.2.8
  • parallax-blog 3.1.1574941215
  • parallaxsome 1.3.6
  • punte 1.1.2
  • revolve 1.3.1
  • ripple 1.2.0
  • scrollme 2.1.0
  • sportsmag 1.2.1
  • storevilla 1.4.1
  • swing-lite 1.1.9
  • the-launcher 1.3.2
  • the-Monday 1.4.1
  • uncode-lite 1.3.1
  • unicon-lite 1.2.6
  • vmag 1.2.7
  • vmagazine-lite 1.3.5
  • vmagazine-news 1.0.5
  • zigcy-baby 1.0.6
  • zigcy-cosmetics 1.0.5
  • zigcy-lite 2.0.9

 

RISK:

Government:

  • Large and medium government entities: High
  • Small government entities: Medium

Businesses:

  • Large and medium business entities: High
  • Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:

A backdoor has been discovered in WordPress AccessPress plugins and themes, which could allow an attacker access to a targeted website. When the compromised plugin or theme is installed, a payload is deployed that creates a webshell into “./wp-includes/vars.php” and then hides its tracks by deleting its files.  When successfully installed, the backdoor gives the threat actor control over the infected website.

RECOMMENDATIONS: We recommend the following actions be taken:

  • Consult the list of affected themes and plugins provided in the Systems Affected section above and verify if you are utilizing any of them in your environment.
  • Update all affected plugins and themes to their newest safe version, published by AccessPress.
  • If an affected plugin or theme was found to be in use, check all web sites and servers for signs of potential compromise.
  • BleepingComputer provided an extensive list of checks that can be used to determine if a site may have been compromised. Information can be found at the reference below in the “Am I affected?” section near the bottom of the article.

REFERENCES:

CVE:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24867

Jetpack:

https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/

BleepingComputer:

https://www.bleepingcomputer.com/news/security/over-90-wordpress-themes-plugins-backdoored-in-supply-chain-attack/

Sucuri Blog:

https://blog.sucuri.net/2022/01/accesspress-themes-hit-with-targeted-supply-chain-attack.html

Recent Posts

Google Chrome Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe of these vulnerabilities could...

Oracle Quarterly Critical Patches Issued April 19, 2022

Multiple vulnerabilities have been discovered in Oracle products, which could allow for remote code execution. April 22 – THREAT INTELLIGENCE UPDATED: A new proof of concept code demonstrating a newly disclosed digital signature bypass vulnerability in Java has been...

WSO2 Products Could Allow for Remote Code Execution

A vulnerability has been discovered in specific WSO2 products, which could allow for remote code execution. WSO2 is an open-source technology provider. It offers an enterprise platform for integrating application programming interfaces (API), applications, and web...