14/09/2017
Backdoor Found in WordPress Plugin With More Than 200,000 Installations
For the past two and a half months, a WordPress plugin named Display Widgets has been used to install a backdoor on WordPress sites across the Internet.
The backdoor code was found between Display Widgets version 2.6.1 (released June 30) and version 2.6.3 (released September 2).
The WordPress.org team has intervened and removed the plugin from the official WordPress Plugins repository. At the time it was removed, the plugin was installed on more than 200,00 sites, albeit we cannot be sure how many of these were updated to a version that included the malicious behavior.
More surprising is that WordPress.org staff members removed the plugin three times before for similar violations. A history of events is compiled below, put together with data aggregated from three different investigations by David Law, White Fir Design, and Wordfence.
Plugin sold to new developer in May
The original Display Widgets is a plugin that allowed WordPress site owners to control which, how, and when WordPress widgets appear on their sites.
Stephanie Wells of Strategy11 developed the plugin, but after switching her focus to a premium version of the plugin, she decided to sell the open source version to a new developer who would have had the time to cater to its userbase.
A month after buying the plugin in May, its new owner released a first new version — v2.6.0 — on June 21.
First takedown
A day later, David Law, an SEO consultant and the author of a competing plugin named Display Widgets SEO Plus, sent an email to the WordPress.org team informing them that version 2.6.0 was breaking WordPress plugin rules by downloading over 38MB of code from a third-party server.
According to Law, this 38MB code contained tracking features that logged traffic on websites using the Display Widgets 2.6.0. The extra code was collecting data such as user IP addresses, user-agent strings, the domain where the data was collected.
Beautiful designs, powerful features, and the freedom to build anything you want. WordPress is both free and priceless at the same time.
