Hidden Backdoor Found In WordPress Captcha Plugin Affects Over 300,000 Sites

[LSW]

Hidden Backdoor Found In WordPress Captcha Plugin Affects Over 300,000 Sites

https://thehackernews.com/2017/12/wordpress-security-plugin.html

Quote

One such incident happened recently when the renowned developer BestWebSoft sold a popular Captcha WordPress plugin to an undisclosed buyer, who then modified the plugin to download and install a hidden backdoor.

In a blog post published on Tuesday, WordFence security firm revealed why WordPress recently kicked a popular Captcha plugin with more than 300,000 active installations out of its official plugin store.

While reviewing the source code of the Captcha plugin, WordFence folks found a severe backdoor that could allow the plugin author or attackers to remotely gain administrative access to WordPress websites without requiring any authentication.