Hackers Exploit WordPress Sites by Silently Injecting Malicious PHP Code
Recent investigations have identified a surge in attacks targeting WordPress websites. These attacks involve the modification of theme files to incorporate unauthorized third-party scripts.
Recent investigations have identified a surge in attacks targeting WordPress websites. These attacks involve the modification of theme files to incorporate unauthorized third-party scripts.
The attacks utilize PHP injections within the functions.php file of active themes. This technique allows external code to be fetched, transforming compromised websites into distributors of malicious ads and malware.
The initial discovery was made when a site owner detected unfamiliar JavaScript execution on their pages. Subsequent analysis revealed that users were unknowingly loading malicious JavaScript from attacker-controlled domains, which posed risks such as data exposure and compromised site integrity.
An inspection of the page source uncovered a script tag referencing porsasystem.com . This finding connected the attack to a broader operation affecting at least 17 different WordPress sites, as indicated by searches on PublicWWW.
VirusTotal confirmed the malicious nature of the URL, with 17 security vendors blocklisting the domain due to harmful content distribution. The JavaScript payload was further analyzed and found to load ads and redirect traffic using cloaking techniques, complicating removal efforts.
Recent investigations have identified a surge in attacks targeting WordPress websites.
A comprehensive file-system audit identified the compromise source as a snippet appended to the theme's functions.php file. While initially appearing harmless, the code dynamically constructed a remote URL and used wp_remote_get to fetch JavaScript, embedding it into the page footer.
Registers and enqueues a script handle, embedding the attack payload into the site's front end. Triggers a server-side HTTP request on each page load to retrieve updated JavaScript. The function employs innocuous naming and lacks comments, blending with legitimate theme code.
Attackers exploit the infrequency with which administrators inspect theme files, allowing them to inject content without detection.
WordPress site owners can protect against such threats by implementing the following practices:
Conduct regular file integrity checks using tools like Wordfence or Sucuri to detect unauthorized modifications. Apply the least privilege principle by restricting write access to theme directories and limiting permissions on the functions.php file. Maintain a secure update workflow by keeping WordPress core, themes, and plugins updated while backing up files and databases before updates. Perform manual code reviews, focusing on functions enqueuing or including external assets, and watch for unfamiliar code. Deploy a Web Application Firewall (WAF) to block malicious HTTP requests and monitor traffic in real-time.
The stealthy injection of PHP code into WordPress theme files is a growing threat that exploits routine maintenance gaps. By embedding functions in functions.php , attackers can hijack sessions and distribute unwanted content without obvious traces. Implementing stringent security measures is essential to transforming WordPress installations into resilient defenses against such attacks.
Based on reporting by GBHackers.