Popular Word Press Plugin Scripts Tampered to Plant Hidden Backdoors on Sites

Summary: An attacker tampered with JavaScript files served for the WordPress plugins PushEngage, OptinMonster, and TrustPulse, and the code created an attacker-controlled admin account and installed a hidden plugin when a logged-in administrator loaded it. Sansec disclosed the campaign on June 13, saw the malicious code in OptinMonster and TrustPulse for about 25 minutes on June 12, and found PushEngage's script still served from some CDN servers into June 14.
What you should know: The hidden plugin opens a web shell that lets anyone with the right URL run code on the server, and because the backdoor stays out of the WordPress dashboard, the only reliable check on more than 1.2 million sites running these plugins is a server-side scan.

Read the original at The Hacker News ↗