Executive Summary

Multiple ShapedPlugin Pro WordPress plugins were distributed with malicious code through the vendor's compromised update server.

This allowed unauthenticated attackers to deploy a second-stage payload on affected sites.

The payload exfiltrates credentials and other sensitive data and grants full control of the compromised sites to the attackers.

• Affected plugins include Smart Post Show Pro before version 4.0.2, Real Testimonials Pro before version 3.2.5, and Product Slider for WooCommerce Pro before version 3.5.3.

Useful 0 Not Useful 0

Impact Analysis

If your site uses any of the affected plugins, attackers can gain full control over your site.

Attackers can exfiltrate credentials and other sensitive data from your site.

This can lead to unauthorized access, data breaches, and potential further exploitation of your site and its users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by looking for indicators of compromise related to the malicious code distributed through the compromised update server.

• Check for network connections to the command-and-control server at IP address 194.76.217.28 on port 2871.
• Look for the presence of a persistent stage file named install-persistent.php in the plugin directories.
• Monitor for beacon endpoint activity or unusual dropper URLs associated with the affected plugins.

Suggested commands might include network monitoring tools like netstat or tcpdump to detect connections to the suspicious IP and port, and file system searches to find the install-persistent.php file.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the affected plugins to the fixed versions released by the vendor.

• Update Smart Post Show Pro to version 4.0.2 or later.
• Update Real Testimonials Pro to version 3.2.5 or later.
• Update Product Slider for WooCommerce Pro to version 3.5.3 or later.

Additionally, remove any detected malicious files such as install-persistent.php and investigate any unauthorized access or data exfiltration.

Useful 0 Not Useful 0