WordPress plugins running on as many as 36,000 websites have been backdoored in a supply-chain attack with unknown origins, security researchers said on Monday.

So far, five plugins are known to be affected in the campaign, which was active as recently as Monday morning, researchers from security firm Wordfence reported. Over the past week, unknown threat actors have added malicious functions to updates available for the plugins on WordPress.org, the official site for the open source WordPress CMS software. When installed, the updates automatically create an attacker-controlled administrative account that provides full control over the compromised site. The updates also add content designed to goose search results.

Poisoning the well

“The injected malicious code is not very sophisticated or heavily obfuscated and contains comments throughout making it easy to follow,” the researchers wrote. “The earliest injection appears to date back to June 21st, 2024, and the threat actor was still actively making updates to plugins as recently as 5 hours ago.”

The five plugins are:

Over the past decade, supply chain attacks have evolved into one of the most effective vectors for installing malware. By poisoning software at the very source, threat actors can infect large numbers of devices when users do nothing more than run a trusted update or installation file. Earlier this year, disaster was narrowly averted after a backdoor planted in the widely used open source XZ Utils code library used by was discovered, largely by luck, a week or two before it was scheduled for general release. Examples of other recent supply-chain attacks abound.

The researchers are in the process of further investigating the malware and how it became available for download in the WordPress plugin channel. Representatives of WordPress, BLAZE, and Social Warfare didn’t respond to emailed questions. Representatives for developers of the remaining three plugins couldn’t be reached because they provided no contact information on their sites.

The Wordfence researchers said the first indication they found of the attack was on Saturday from this post by a member of the WordPress plugins review team. The researchers analyzed the malicious file and identified four other plugins that were infected with similar code. The researchers wrote further:

At this stage, we know that the injected malware attempts to create a new administrative user account and then sends those details back to the attacker-controlled server. In addition, it appears the threat actor also injected malicious JavaScript into the footer of websites that appears to add SEO spam throughout the website. The injected malicious code is not very sophisticated or heavily obfuscated and contains comments throughout making it easy to follow. The earliest injection appears to date back to June 21st, 2024, and the threat actor was still actively making updates to plugins as recently as 5 hours ago. At this point we do not know exactly how the threat actor was able to infect these plugins.

Anyone who has installed one of these plugins should uninstall it immediately and carefully inspect their site for recently created admin accounts and malicious or unauthorized content. Sites that use the Wordfence Vulnerability Scanner will receive a warning if they’re running one of the plugins.

The Wordfence post also recommended people check their sites for connections from the IP address 94.156.79.8 and admin accounts with the usernames Options or PluginAuth.