Summary
A backdoor has been discovered in WordPress AccessPress Plugins and Themes which allows threat actor to access the targeted website. AccessPress plugins and themes are used to provide website functionality and design options to website administrators. Successful exploitation of this backdoor could allow an attacker to redirect users to malicious sites as well as access to the vulnerable website.
Recommendations:
Those who are using these plugins are required to scan the sites for signs of compromise by doing the following:
- Check your wp-includes/vars.php file around lines 146-158. If you see a “wp_is_mobile_fix” function there with some obfuscated code, you’ve been compromised.
- Query your file system for “wp_is_mobile_fix” or “wp-theme-connect” to see if there are any affected files
- Replace your core WordPress files with fresh copies.
- Upgrade the affected plugins and switch to a different theme.
- Change the wp-admin and database passwords.
References:
