Script exploited in WordPress theme, bypasses security, sends spam

News by Teri Robinson

Hackers, flying beneath the radar, have been using script that's part of a WordPress theme to send spam.

During what was called a routine cleanup investigation, researchers at Sucuri found that hackers were exploiting a PHP script in a premium WordPress theme to send spam.

“While many themes include email functionality, this particular one was troublesome because the script was written without any security checks or direct access prevention,” Sucuri Remediation Team Lead Rodrigo Escobar wrote in a blog. “Without the proper security functions in place, this script can easily be exploited to abuse features and send mass email spam.”

The script, which uses data from POST parameters to send email and is designed to work within the theme, can stand alone as well, “bypassing all security checks in other theme files,” Escobar said. He added that the issue had been exploited by attackers “for quite a while” and were able “to send as many emails as they would like, only limited by the server's configurations.”


Find this article useful?

Get more great articles like this in your inbox every lunchtime

Webcasts and interviews 

Interview - Everyone has an Achilles heel: The new security paradigm

How can we defend networks now that the perimeter has all but disappeared?
Brought to you in partnership with ExtraHop