WordPress sites are being hit by sneaky code that can steal credit card data

A vulnerability in a WordPress plugin is being abused to install malicious code and steal people’s payment data, experts have warned.

A report from cybersecurity researchers Sucuri, who discovered the attack, claim Dessky Snippets, a relatively unknown WordPress plugin, allows website administrators to add custom PHP code to their sites.

In these instances, the report states, the attackers were looking for active installations among websites with online shops. Once found, they would use the vulnerability to install a server-side PHP credit card skimming malware, allowing them to steal financial data from the victims.

New payment forms

“This malicious code was saved in the dnsp_settings option in the WordPress wp_options table and was designed to modify the checkout process in WooCommerce by manipulating the billing form and injecting its own code,” Sucuri’s researchers said in their writeup.

Namely, this new code adds additional forms to the checkout page, where customers are asked to add their names, addresses, credit card numbers, expiry dates, and CVV numbers. It is also worth mentioning that on these fake forms, autocomplete is disabled. Hence, users who have autocomplete turned on should see this as a red flag.

“By manually disabling this feature on the fake checkout form it reduces the likelihood that the browser will warn the user that sensitive information is being entered, and ensures that the fields stay blank until manually filled out by the user, reducing suspicion and making the fields appear as regular, necessary inputs for the transaction,” Sucuri explained.

Being the most popular website builder out there, WordPress is a major target among cybercriminals. However, since the platform is generally considered safe, the attackers shifted their attention towards plugins and themes, which are far less secure. As a general rule of thumb, WP users should only keep those plugins and themes they are actually using, and should make sure they are always up to date.

Via The Hacker News