WordPress sites are being hit by sneaky code that can steal credit card data
If you have this little-known WordPress plugin installed, be careful
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A vulnerability in a WordPress plugin is being abused to install malicious code and steal people’s payment data, experts have warned.
A report from cybersecurity researchers Sucuri, who discovered the attack, claim Dessky Snippets, a relatively unknown WordPress plugin, allows website administrators to add custom PHP code to their sites.
In these instances, the report states, the attackers were looking for active installations among websites with online shops. Once found, they would use the vulnerability to install a server-side PHP credit card skimmingmalware, allowing them to steal financial data from the victims.
New payment forms
“This malicious code was saved in the dnsp_settings option in the WordPress wp_options table and was designed to modify the checkout process in WooCommerce by manipulating the billing form and injecting its own code,” Sucuri’s researchers said in their writeup.
Namely, this new code adds additional forms to the checkout page, where customers are asked to add their names, addresses, credit card numbers, expiry dates, and CVV numbers. It is also worth mentioning that on these fake forms, autocomplete is disabled. Hence, users who have autocomplete turned on should see this as a red flag.
“By manually disabling this feature on the fake checkout form it reduces the likelihood that the browser will warn the user that sensitive information is being entered, and ensures that the fields stay blank until manually filled out by the user, reducing suspicion and making the fields appear as regular, necessary inputs for the transaction,” Sucuri explained.
Being the most popularwebsite builderout there, WordPress is a major target among cybercriminals. However, since the platform is generally considered safe, the attackers shifted their attention towards plugins and themes, which are far less secure. As a general rule of thumb, WP users should only keep those plugins and themes they are actually using, and should make sure they are always up to date.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
ViaThe Hacker News
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Thousands of employees could be falling victim to obvious phishing scams every month
