WordPress flaw lets attackers install PHP backdoors

Key Takeaways

• A new attack chain, dubbed TRUST#GRAFT, exploits active WordPress administrator sessions to install persistent PHP backdoors.
• The attack leverages a compromised page to execute a JavaScript loader, which then uses the administrator’s authenticated browser session to upload and activate a malicious plugin.
• The malicious plugin, “Web Media Optimizer,” hides itself as a “must-use” plugin, making detection and removal challenging.
• This attack highlights the significant risk of browsing public websites while logged into a WordPress admin panel.

A recently uncovered attack chain is exploiting a common, yet risky, habit among WordPress administrators: maintaining an active login session while browsing other websites. This vulnerability allows attackers to install hidden PHP backdoors on WordPress sites without ever needing the administrator’s password.

The method involves a sophisticated JavaScript loader that waits for a logged-in administrator to visit a compromised page. Once triggered, it hijacks the trusted browser session to surreptitiously inject a persistent backdoor into the WordPress installation. This technique bypasses traditional password protections by leveraging the administrator’s own authenticated browser to perform the malicious actions.

Recent incidents underscore the prevalence and danger of this attack pattern, including a campaign that potentially exposed over 1.2 million websites. Malware that only activates during active, logged-in sessions poses a significant challenge for conventional security scans, elevating concerns for website owners and administrators.

Security researchers at Securonix Threat Research, Akshay Gaikwad and Aaron Beardslee, identified this malware and named the entire sequence TRUST#GRAFT. Their analysis revealed that the JavaScript loader does not attempt to break the WordPress login mechanism. Instead, it checks if a visitor is already authenticated as an administrator and then reuses that established session to introduce new, malicious code to the site. Securonix noted that the initial vector for how the JavaScript script reaches the compromised page remains unconfirmed.

Hackers Can Abuse Logged-In WordPress Admin Sessions

The infection process initiates with a deceptive security verification. The malicious script overlays the current webpage with a full-screen frame, mimicking a legitimate Cloudflare “Just a moment” security check. During this simulated waiting period, the script discreetly gathers system information, including screen dimensions, graphics data, timezone, and the number of installed plugins. It also actively checks for indicators of automated analysis tools, suggesting an attempt to evade detection.

After a brief interaction, such as solving a small puzzle, the browser transmits this collected data to a command-and-control server. This server then determines whether to proceed with the next stage of the attack. The critical step that follows involves the script leveraging the browser’s existing login cookies to request the WordPress plugin upload page. From this page, it extracts a WordPress security token, known as a nonce.

Following this, the script downloads a ZIP archive, named wm.zip, from a staging server. It then uploads this file through the standard WordPress plugin installation endpoint. If the upload is successful, the script navigates to the plugins page and activates the newly installed plugin. WordPress processes each of these requests as legitimate because the browser is already authenticated with the necessary administrative permissions to install plugins.

Securonix emphasizes that this attack is not a standalone login bypass. It specifically requires an administrator account that is already logged in and possesses the necessary privileges to install plugins. Nevertheless, the risk remains substantial for any administrator who browses public websites while simultaneously logged into their wp-admin dashboard, or who uses a single browser profile for both general browsing and site management.

Persistent PHP Backdoor Hides in Must-Use Plugins

The uploaded wm.zip file contains a PHP plugin deceptively named “Web Media Optimizer, version 2.1.” While its name suggests a benign utility for image or media optimization, Securonix has confirmed it functions as a backdoor. This malicious plugin injects remote JavaScript into public-facing pages, disables TLS certificate checks when retrieving its controller script, and can establish an administrator login cookie for the primary admin account using a hardcoded token.

A key aspect of this plugin’s design is its self-preservation mechanism. Upon activation, it copies itself to the wp-content/mu-plugins/wmedia-recovery.php directory. WordPress automatically loads all files within the mu-plugins folder, and crucially, these “must-use” plugins do not appear on the standard Plugins page. This tactic of hiding malware within must-use plugins has been observed before, highlighting why merely removing the visible plugin is insufficient for complete remediation.

What You Should Do

• Use Separate Browser Profiles: Dedicate a distinct browser profile or even an entirely separate browser solely for managing your WordPress admin panel. This isolates your administrative session from general web browsing activities.
• Log Out Promptly: Always log out of your WordPress admin session immediately after completing administrative tasks, especially if you plan to browse other websites.
• Rotate Administrator Credentials: Regularly change passwords for all administrator accounts.
• Limit Plugin Upload Rights: Where possible, restrict the ability to upload new plugins to only essential administrator accounts.
• Monitor mu-plugins Directory: Periodically check the wp-content/mu-plugins/ directory for any suspicious or unfamiliar PHP files. Since these plugins are hidden from the standard WordPress interface, manual inspection is crucial.
• Thorough Cleanup: If a compromise is suspected, ensure you remove not only the visible malicious plugin but also its copy in wp-content/mu-plugins/wmedia-recovery.php and any associated remote script sources to prevent reinfection.
• Review Backdoor Cases: Stay informed about recent WordPress self-restoring backdoor malware cases, as deleted files can sometimes reappear.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.