WordPress

Reported Context (236)

Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. WordPress Fix Can Leave a Brief Exploitation Window During Installation
We also have direct access to their affiliate panel, which includes the malicious WordPress plugin documented by GoDaddy, as well as previously unknown lures. Infoblox Links Hotejka to Help TDS and Predicts Its Cloudflare Pages Domains
The domain weatherplllatform[.]com was previously used as Balada injector infrastructure, infecting thousands of WordPress sites during the campaign’s peak and was Sucuri’s second most-blocklisted resource in 2022. Infoblox Tracks Three Actors Reusing Expired Malicious Domains
The opsec issues cut both ways though: because every streaming site runs on stock WordPress, Sable Squirrel’s own sites are a soft target, and we have watched at least one of them get compromised by an unrelated Infoblox Links Sable Squirrel’s Expired Domains to Streaming, Gambling and RAT C2
During my security research at Picus Security, I discovered a race condition in the WordPress core updater that can allow an unauthenticated attacker to replace a site’s live wp-config.php during a core update. WordPress Core Updater Race Condition Enables Unauthenticated Code Execution

CVE (280)

Malware (262)

People (123)

Threat Actors (167)

MITRE ATT&CK (212)

Vendors (246)

Products (581)

Tools (226)

Industries (110)

Countries (83)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.