Cybercriminals compromised the update mechanism for the Smart Slider 3 Pro plugin used on WordPress and Joomla, spreading a tainted version containing multiple secret entry points.

The developer states that only version 3.5.1.35 of the Pro plugin is affected and advises users to upgrade to the newest version, currently 3.5.1.36, or revert to version 3.5.1.34 or earlier.

Besides adding secret access points, the infected update generated a stealth administrator account and extracted confidential information.

Smart Slider 3 for WordPress is implemented on over 900,000 websites to build adaptable sliders using a real-time editor, offering various layouts and designs.

The vendor reports that the malicious update was distributed starting April 7, and some websites may have already installed it.

An analysis by PatchStack, a company specializing in WordPress and open-source software security, indicates that the malware is a comprehensive, multi-layered toolkit incorporated into the plugin’s primary file, while maintaining Smart Slider’s regular operation.

Researchers discovered that the malicious toolkit permits an external attacker to execute commands without needing credentials via specially crafted HTTP headers. It also features a secondary authenticated backdoor with both PHP evaluation and operating system command execution capabilities, as well as automated credential theft.

The malware ensures its continued presence through various methods, including creating a concealed admin account and saving credentials in the database.

Furthermore, it establishes a ‘mu-plugins’ directory and adds a required plugin with a filename designed to appear like a genuine caching component.

Must-use plugins are unique because they load automatically, cannot be deactivated from the WordPress control panel, and are hidden from the plugins list.

PatchStack points out that the malicious kit also inserts a backdoor into the active theme’s functions.php file, allowing it to remain active as long as the theme is in use.

Another persistence strategy involves injecting a PHP file into the wp-includes directory with a filename that imitates a valid WordPress core class.

“Unlike other persistence methods, this backdoor doesn’t rely on the WordPress database but extracts its authentication key from a .cache_key file located in the same directory,” PatchStack researchers explain.

Consequently, modifying the database credentials does not eliminate the backdoor, which remains functional “even if WordPress doesn’t fully initialize.”

The vendor issued a similar warning for Joomla installations, stating that the malicious code in version 3.5.1.35 of the plugin may create a hidden admin account (usually prefixed with wpsvc_), install additional backdoors in the /cache and /media directories, and steal website information and credentials.

The infected update was pushed to users on April 7, but the Smart Slider team suggests April 5 as the safest date for restoring backups to factor in time zone variations.

“A security incident compromised the update system responsible for distributing Smart Slider 3 Pro for WordPress,” the vendor’s disclosure reads.

If no backup exists, removing the compromised plugin and installing a clean version (3.5.1.36) is recommended.

Administrators who discover the compromised plugin version should assume complete site compromise and undertake the following actions:

• Remove malicious users, files, and database entries
• Reinstall WordPress core, plugins, and themes from reliable sources
• Change all logins and passwords (WP, DB, FTP/SSH, hosting, email)
• Generate new WordPress security keys (salts)
• Check for residual malware and review logs

The vendor also offers a detailed manual cleanup procedure for WordPress and Joomla, starting with enabling maintenance mode and backing up the site.

Admins should then purge the site of unauthorized admin accounts, eliminate all malicious components, and reinstall all core files, plugins, and themes. Changing all passwords and scanning for further malware is also advised.

Final recommendations include enhancing site security by enabling two-factor authentication (2FA), updating components to the latest versions, limiting admin access, and employing strong, unique passwords.