Persistent XSS via CSRF in WP Meta and Date Remover
John Castro During regular research audits for our Sucuri Firewall (WAF), we discovered a Cross Site Request Forgery (CSRF) leading to a persistent Cross Site Scripting vulnerability…
Replica Spam on Poorly Maintained ASP Site
Denis Sinegubko Although the majority of sites we work on are powered by PHP, we still have clients whose sites use other programming languages. The other day…
Cronjob Backdoors
Cesar Anjos Attackers commonly rely on backdoors to easily gain reentry and maintain control over a website. They also use PHP functions to further deepen the level…
How Stolen Ecommerce Data is Sold on the Darknet
Luke Leal We have recently published posts regarding banking malware and some of the ways it uses compromised websites to infect victim’s devices (smartphones, computers, POS terminals).…
Insufficient Privilege Validation in WooCommerce Checkout Manager
Due to the poor handling of a vulnerability disclosure, a new attack vector has appeared for the WooCommerce Checkout Manager WordPress plugin and is affecting…
Typo 3 Spam Infection
Ben Martin Here at Sucuri most of the malware that we deal with is on CMS platforms like: WordPress, Joomla, Drupal, Magento, and others. But every now…
Fake relatable domain used to distribute ads
Krasimir Konov Malicious users try to hide their malicious scripts in many ways these days, some more clever then others, in this case we look at a…
Plugins Added to Malicious Campaign
We continue to see an increase in the number of plugins attacked as part of a campaign that’s been active for quite a long time.…
Free Premium themes? There’s always a catch
Pedro Peixoto OK, so we’ve all been there. We want something Premium, such as a paid version of an app or piece of software, but it would…
Sucuri’s 10th Anniversary
Daniel Cid It feels like yesterday, but it has been 10 years since the domain sucuri.net was registered. Happy 10th Birthday, Sucuri! For us, 2009 marks the…
WP Plugin Hider
One of our analysts recently found an interesting injection that has been found on WordPress installations. Installed by hacker, it is used to hide a…