Another WordPress commercial plugin gets exploited in the wild

Hackers are exploiting an old vulnerability in a commercial WordPress plugin to break into websites and plant backdoors. Ongoing attacks have been first spotted at the end of last month by incident responders from Defiant, the company behind the Wordfence WordPress firewall plugin. The vulnerability exploited in the attacks affects "WP Cost Estimation & Payment Forms Builder," a commercial WordPress plugin for building e-commerce-centric forms that has been on sale on the CodeCanyon marketplace for the last five years. In an interview with ZDNet, Defiant Threat Analyst Mikey Veenstra said hackers were using the hacked site they investigated to hijack incoming traffic and redirect it to other websites. He didn't exclude the attackers abusing the backdoor for other nefarious activities later down the line. In a report published on the Wordfence official blog, Veenstra and his colleagues broke down the technical details of the exploited vulnerability. He said hackers were abusing an AJAX-related flaw in the plugin's upload functionality to save files with nonsensical extensions (such as ngfndfgsdcas.tss) on targeted sites. In a second step of the exploitation routine, the attackers would then upload a .htaccess file that associated the non-standard file extension with the site's PHP interpreter, ensuring that when they'd later access the file, the PHP code contained within would execute and activate the backdoor. In other cases Veenstra and his colleagues investigated, the attac...