{"id":168,"date":"2019-03-11T23:30:13","date_gmt":"2019-03-11T21:30:13","guid":{"rendered":"https:\/\/www.mozdomains.com\/blog\/en\/?p=168"},"modified":"2021-07-09T01:14:33","modified_gmt":"2021-07-08T23:14:33","slug":"infected-wordpress-themes-still-on-wordpress-org","status":"publish","type":"post","link":"https:\/\/www.mozdomains.com\/blog\/en\/website-security\/infected-wordpress-themes-still-on-wordpress-org\/","title":{"rendered":"Infected WordPress Themes Still on WordPress.org"},"content":{"rendered":"

Part 1:<\/strong><\/p>\n

FAKE SOCIAL.PNG CONTINUES TO RUN RAMPANT ON WORDPRESS THEMES<\/strong><\/p>\n

Having come across many exploits and vulnerabilities it is no surprise that WordPress,
\nbeing one of the most common CMS used, seems to be a hacker favorite.<\/p>\n

In order to stay proactive, we researched wordpress.org Apache Subversion (SVN) and discovered some major commonalities within some infected themes.<\/p>\n

This presents a major concern as these infected files can be quite easily installed from the wordpress.org site directly.<\/p>\n

During the next couple of blog posts we will publish a series of articles\u00a0<\/em>titled\u00a0INFECTED WORDPRESS THEMES STILL ON WORPRESS.ORG<\/em>, where we will share with you our findings in the hopes of helping stop the spread of these infections through awareness.<\/p>\n

INFECTION OF FILES WITH IMAGES<\/strong><\/p>\n

The first set of deceiving files we identified were highly obfuscated code in some images. Within certain PHP scripts we noticed sets of false-image files that were a real serious threat.<\/p>\n

Normally a user would think that their web antivirus scanner would detect this code but unfortunately many web malware antivirus\u2019 scans do not perform a file extension scan so that they can maximize their scanning speed.<\/p>\n

The following is a list of the infected WordPress themes we have discovered:<\/p>\n