The Center for Cyber security Belgium (CCB) is aware of an active campaign targetting WordPress websites using the WPGateway plugin.
The attackers exploit a vulnerability in the WPGateway plugin to create a new administrator account. This allows the attackers to gain full control of website.
Wordfence detected 4,6 million attacks that are trying to exploit the WPGateway vulnerability on 280.000 different websites on september the 14th.
Recommended Actions
- The CCB advises to remove the WPGateway plugin until a patch is available.
- The CCB recommends to verify that no malicious administrator accounts have been created
- Threat actors have created the following username "rangex."
- (It is advised to check for other uncommon usernames)
References
https://vulners.com/thn/THN:9D37BC65E19BC86F51BB9D0C7858EFF7?utm_source=feedly&utm_medium=rss&utm_campaign=rss
https://www.bleepingcomputer.com/news/security/zero-day-in-wpgateway-wordpress-plugin-actively-exploited-in-attacks