Attackers are actively compromising WordPress e-commerce sites by leveraging a critical flaw in a third-party plugin to deploy persistent backdoors. The campaign, documented by BleepingComputer, targets the WooCommerce Wholesale Lead Capture premium plugin, exploiting a vulnerability that requires only the most basic of user privileges to achieve full site control.
The core issue, tracked as CVE-2024-5754, is an authenticated arbitrary file upload flaw. Disturbingly, an attacker needs only a subscriber-level account—a default, low-privilege role in WordPress—to exploit the bug. Upon successful exploitation, they can upload a malicious PHP file, creating a backdoor that grants them permanent, remote access to the server. This can lead to complete site takeover, sensitive data theft, and use of the server for further attacks, presenting a severe threat to online retailers and their customers.
The vulnerability impacts all versions of the plugin up to 1.6.1. The plugin developer has released a fix in version 1.6.2.
Immediate Mitigation Steps for Administrators:
1. Update Now: Upgrade the WooCommerce Wholesale Lead Capture plugin to version 1.6.2 immediately. Version 1.6.3 is recommended as it also patches a separate issue.
2. Scan for Compromise: For sites that may have been exposed, perform a security audit. Specifically, inspect the uploads directory for suspiciously modified or newly created PHP files, which are common indicators of a web shell backdoor.
3. Review Logs: Examine user activity logs for any evidence of unauthorized access or suspicious actions tied to subscriber accounts.
This incident underscores the inherent risks of third-party plugins, which expand functionality but also the potential attack surface. The fact that a low-privilege account can be leveraged for such severe impact emphasizes critical security best practices: enforcing the principle of least privilege, maintaining rigorous patch management, and conducting regular security audits.
A second vulnerability in the same plugin, CVE-2024-28000 related to a weak password reset mechanism, was also patched in version 1.6.3. Updating to the latest version addresses both flaws. For businesses running WordPress, this event is a clear reminder that vigilant management of every component is essential to protecting site integrity and customer trust.
攻擊者正積極利用一個第三方插件的嚴重漏洞，入侵 WordPress 電商網站並部署持久性後門。據 BleepingComputer 記錄的這次攻擊行動，針對的是 WooCommerce Wholesale Lead Capture 付費插件，該漏洞僅需最基本的用戶權限即可實現對網站的完全控制。
被追蹤為 CVE-2024-5754 的核心問題，是一個已驗證的任意檔案上傳漏洞。令人擔憂的是，攻擊者僅需一個「訂閱者」級別的帳戶——WordPress 中一個預設的低權限角色——就能利用此缺陷。成功利用後，他們可以上傳惡意 PHP 檔案，建立一個後門，使其能夠永久遠端訪問伺服器。這可能導致網站完全被接管、敏感資料被盜用，以及伺服器被用於進一步的攻擊，對網上零售商及其客戶構成嚴重威脅。
此漏洞影響該插件直至 1.6.1 版本的所有版本。插件開發者已在 1.6.2 版本中發布了修復。
管理員的緊急緩解措施：
1. 立即更新： 立即將 WooCommerce Wholesale Lead Capture 插件升級至 1.6.2 版本。建議升級至 1.6.3 版本，因其同時修補了另一個問題。
2. 掃描是否已被入侵： 對於可能已受影響的網站，應進行安全審計。具體而言，檢查 uploads 目錄中是否有被可疑修改或新建的 PHP 檔案，這些是 web shell 後門的常見指標。
3. 審查日誌： 查看用戶活動日誌，尋找任何與訂閱者帳戶相關的未經授權訪問或可疑操作的證據。
此事件凸顯了第三方插件固有的風險：它們擴展了功能，但也擴大了潛在的攻擊面。低權限帳戶能被利用以造成如此嚴重影響的事實，強調了關鍵的安全最佳實踐：執行最低權限原則、維護嚴格的補丁管理以及定期進行安全審計。
該插件中的另一個漏洞 CVE-2024-28000，與一個弱密碼重置機制有關，也在 1.6.3 版本中得到了修補。升級到最新版本可解決這兩個缺陷。對於使用 WordPress 的企業來說，這一事件清楚地提醒，謹慎管理每一個組件對於保護網站完整性及客戶信任至關重要。