On 2 Wordpress instances that I'm hosting, I've seen several password reset requests on 3 different accounts in the last days, some of which were successful, even though I am sure that the reset link in the e-mail was not clicked. Since the e-mail addresses are hosted at different providers, I think it is unlikely that the e-mail account itself or its provider is breached. The password reset requests were triggered by IP addresses registered in Russia and Turkey (104.192.101.190, 37.247.112.93, 92.118.170.216, 2a03:afc0:9::9).
One one of my instances, 2 of the breached user accounts are administrators. On that instance, I have made the following observations:
- An Application Password was created for each of the users.
- Some suspicious PHP files containing obfuscated code have appeared in the
wp-contentfolder (wp-content/options.php,wp-content/2020/xzmpocbt.php,wp-content/2024/swryjqcg.php). All 3 have an mtime of2022-01-28T23:33:19, but they don't appear in the backup from 2 days ago, so it seems like they were created during the attack. Virus scanners seem to flag the files asHEUR:Backdoor.PHP.WebShell.gen.
On the other instance, the breached user account is not an admin, and I have not detected anything suspicious there yet. However, I don't have much logging in place and I'm not sure if Wordpress has anything like an audit log, so I'm not even sure where to look for suspicious changes.
Both Wordpress instances are running the official Docker image and have been last updated a few weeks ago. Other Wordpress instances that I'm hosting in the same way don't seem to be affected.
Both instances have a variety of active plugins. The ones that both have in common are:
- Advanced Editor Tools
- Classic Editor
- Contact Form 7
- HumanCaptcha by Outerbridge
- iframe
- Post SMTP
- Simple Lightbox
To mitigate the issue, I have deleted the application passwords, reset the passwords of the affected user accounts, deleted the suspicious files, pulled the latest docker image, recreated the docker container and reinstalled all plugins.
My questions are:
- Are there any known recent security vulnerabilities in Wordpress itself or some of my plugins that could have caused this?
- Do you have any more tips how I could look for suspicious changes and how I could revert the possible damage caused by the attack?
