EssentialPlugin Vendor plugins contains Backdoor

luuk

Are you aware of the current compromised plugin vendor EssentialPlugin?
https://patchstack.com/articles/critical-supply-chain-compromise-on-20-plugins-by-essentialplugin/
https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/

CPFence did pickup on the backdoor but only to late and the malicious code got injected in the wp-config.php
The wp-config did jump from 3.76kb to 9.45kb. this should raise a redflag and inform the administrator.
I've added the code for the developer to dissect. and hopefully mitigate this in the future.
############### Malware removed #############

cPFence

luuk

Thank you for reporting this. We will try to improve detection for it in the future. It is recommended to use the Vulnerability Manager in cPFence to ensure there are no severe issues on the server. The WordPress ecosystem encounters similar issues on a weekly basis.

cPFence

luuk

We just released version 3.4.23 with detection support for this malware family, including auto cleanup and instant admin notifications. Stay secure.