Backdoor in Link Factory WordPress Plugin

Executive Summary

The Link Factory WordPress plugin is a backdoor disguised as a homepage sentence publisher. It exposes an operator-controlled REST API that allows an attacker to perform malicious actions without needing a WordPress account. The attacker can create hidden administrator accounts, publish fake posts, inject malicious HTML for SEO manipulation, and fingerprint the plugin's presence. The plugin uses a hardcoded public key for authentication, except for a health check endpoint.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the Link Factory plugin by inspecting WordPress plugin directories for files matching 'link-factory' or '/wp-json/link-factory/v1/' endpoints. Use commands like 'curl -s http://yoursite.com/wp-json/' to list REST API endpoints or 'grep -r "link-factory" /path/to/wordpress/wp-content/plugins/' to search plugin files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to fully compromise your WordPress site. They can create hidden administrator accounts, take control of your site, publish unauthorized content, and inject malicious code for black-hat SEO purposes. The attacker can maintain access even if you remove the plugin, leading to persistent site takeover.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access and control of a WordPress site, enabling creation of hidden admin accounts, arbitrary post publishing, and HTML injection. Such unauthorized access could lead to data breaches, unauthorized data processing, or data tampering, which are critical violations under GDPR and HIPAA. Compliance requires protecting user data and ensuring only authorized access, both of which are compromised here.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately remove the Link Factory plugin from your WordPress installation via the admin panel or by deleting the plugin directory. Check for unauthorized administrator accounts with 'lf_' prefixes and remove them. Review posts for suspicious content and inspect the site's footer for hidden HTML injections.

Useful 0 Not Useful 0