CVE-2024-6297: Several WordPress.org Plugins <= Various Versions - Injected Backdoor
Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
WordPress.org Plugins (affected)from your environment.Uninstall the compromised WordPress.org plugins (the ones described as having injected backdoor PHP scripts) for the time being.
- Compensating control
Run a complete malware scan to identify any remaining malicious code in the WordPress installation and affected plugin files.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6297?
The severity of CVE-2024-6297 is considered high due to the potential for database credential exfiltration and unauthorized access.
How do I fix CVE-2024-6297?
To fix CVE-2024-6297, you should immediately update any affected WordPress plugins to their latest secure versions.
What plugins are affected by CVE-2024-6297?
CVE-2024-6297 affects several WordPress plugins that have been compromised, though the exact list may vary.
What should I do if I suspect my site is compromised due to CVE-2024-6297?
If you suspect a compromise from CVE-2024-6297, perform a thorough security audit and restore your site from a clean backup.
How can I prevent vulnerabilities like CVE-2024-6297 in the future?
To prevent future vulnerabilities like CVE-2024-6297, regularly update all plugins and themes and implement strong security practices for your WordPress site.