Online Services

eWorldLinx

Tag: Wordfence

  • Wordfence Is Now Defiant

    Today we are announcing that our company name is changing to Defiant Inc. Over the past 5 years we have grown significantly and have expanded beyond WordPress. As a security organization, we now have a stable of products and services to offer our customers. To reflect this change, we are changing the name of the company that produces Wordfence to Defiant Inc.

    Our new corporate website will be defiant.com. We have written a full announcement with more details on the Defiant.com blog. I recommend you head over there and read about this exciting change and where our company is headed.

    I know that some of you may have questions about this change, so to put your minds at ease, I’m including a short FAQ about the name change below:

    Why are you changing your company name?

    For legacy reasons, until this point our company name has been Feedjit Inc. But that name has nothing to do with security or the products and services we offer. It is related to an old business we were in many years ago that provided real-time analytics services.

    We have been growing so fast since the 2012 Wordfence launch that we never got around to changing our corporate name. Today, we are finally doing that, and we are very excited to announce our new company name, Defiant Inc., and our new corporate website at defiant.com.

    Why didn’t you change the name to Wordfence Inc?

    Our team provides a growing stable of products and services. You can read more about those on the Defiant website in our announcement. Some of those security products are not just for WordPress – they support Joomla, Magento and other platforms.

    As we grow, and, in some cases, expand beyond WordPress, we need a company name that can be an umbrella for all of our products and services. Defiant Inc is that name and that umbrella. The defiant.com website is a jumping-off point where you can learn about everything our company does, get corporate news and learn about openings if you want to join our team.

    Will this affect the Wordfence security plugin and the service I receive from Wordfence in any way?

    Wordfence is our core business and our biggest source of revenue. It is therefore our main focus in everything that we do. Wordfence will continue to grow, and we will continue to deliver the amazing product development and customer service you have become accustomed to.

    Did Wordfence just raise funding or close some kind of investment round? Did you get bought by someone?

    Hell no! We are still an independent, profitable and growing company. The Defiant name should give you a clear picture of how independent we are and want to remain. We aren’t run by bankers, and we aren’t run by some mega-corp with tacky Super Bowl ads.

    Kerry, Dan and I are still an independent and highly capable executive team. Along with our incredible engineering team and customer service team, we will continue to deliver awesome security for your website, your customers and your assets.

    Can I be Defiant?

    Yes you can. If you use any of our free or paid products, like Wordfence, Gravityscan, our site cleaning service, our security audit or if you chat with our customer service team on the free forums or in our Premium support system, you stand Defiant alongside us in protecting your website, your customers and your assets from hackers.

    As always, I will be around to answer any questions you may have in the comments.

    Mark Maunder – Defiant CEO.

    The post Wordfence Is Now Defiant appeared first on Wordfence.

  • Postman SMTP Plugin With Unpatched Vulnerability Removed From Directory

    We have received a number of questions regarding the Postman SMTP plugin which was removed from the WordPress.org directory this week. According to an archived snapshot, the plugin is installed on over 100,000 websites. We assume it was removed because it contains a publicly known reflected cross-site scripting (XSS) vulnerability that has not been fixed. Both Wordfence Free and Premium users who have the firewall enabled have been protected against attempts to exploit this vulnerability from day one. In addition, we alerted all Wordfence users who have the plugin installed when it was removed from the plugin directory.

    Timeline

    On June 29, an unnamed security researcher published the details of the vulnerability, including a proof of concept. A proof of concept is a demonstration that shows the plugin author (and in this case the entire internet, including potential attackers) how to exploit the security vulnerability. The security researcher had apparently attempted to reach the author but had been unable to.

    On October 4 (we think, as we have no way of confirming the exact date), the WordPress.org directory team removed the plugin.

    Also on October 4, someone named Diego (no last name given) reported in comments on the original vulnerability disclosure post that he had reached the author, so hopefully a fix will be released soon.

    Wordfence Firewall Includes Robust XSS Protection

    The Wordfence firewall includes protection against new and emerging XSS attacks. Both Wordfence free and Premium users have been protected against this attack since (and before) it was made public. This is a great example of why using a firewall to protect your website is so important: you are immediately protected against most new threats.

    In cases where we don’t already protect against a new threat, we develop a new firewall rule, deploying it to our Premium customers in real-time and free customers 30 days later. This ‘virtual patching’ by our security analysts and developers keeps your sites safe.

    Wordfence Alerts You When Plugins Are Removed From WordPress.org

    When plugins you have installed on your site are removed from WordPress.org, Wordfence alerts you. There is a long list of reasons why the plugin team at WordPress.org might remove a plugin from the directory. One common reason is that someone has discovered a security vulnerability that has not yet been fixed. Since they don’t publicly announce that plugins have been removed, nor why, it is prudent for site owners to treat the plugin as a potential security risk and take reasonable precautions.

    We wrote at length about how to handle this situation when we released this feature back in June as a part of the 6.3.11 release.

    What To Do

    If you have the Postman SMTP plugin installed on your site, we suggest that you remove it immediately. It contains an unpatched security vulnerability and it appears the author may have abandoned it.

    If you haven’t already, we suggest that you install Wordfence on all of your WordPress websites. It will alert you when your plugins have been abandoned or removed from the the WordPress directory. Its firewall will also protect you against new and emerging attacks.

    Finally, consider upgrading to Wordfence Premium if you haven’t already. The real-time firewall rule updates will protect you from the latest threats. In addition, the real-time IP blacklist will stop all attacks from the most malicious IPs, regardless of what they’re up to.

    The post Postman SMTP Plugin With Unpatched Vulnerability Removed From Directory appeared first on Wordfence.

  • Staying Ahead of WordPress Attackers with the Real-Time IP Blacklist

    WordPress sites are under constant attack by criminals around the world. It is unnerving to see them at work, looking for security vulnerabilities to exploit and trying thousands of passwords. And when they are successful, they inflict pain in the form of lost revenue, damaged reputation and clean-up expenses. It’s no wonder that Wordfence users love our blocking features. There’s nothing more satisfying than taking direct action against an evil adversary.

    We like blocking the bad guys too. That’s why we added a real-time IP blacklist for our Premium customers in March. In today’s post we do a deep dive on how the blacklist works. We also find out whether keeping an eye on Live Traffic and Monthly Attack Reports and blocking all the bad guys yourself is a viable alternative to the real-time blacklist. Let’s take a look!

    Real-Time IP Blacklist Stats for August 2017

    For our deep dive we took a look at all of the changes to the blacklist for August 2017 and sliced and diced it for you. The blacklist is updated in real-time using algorithms we have developed that run on our Big Data platform. IPs can be added and removed multiple times during the month, so in the numbers below we included each add and remove in our counts.

    537,951 IPs Added in August

    During the month an average of 17,353 IPs were added to the blacklist each day. That’s over 12 per minute, so if you were to attempt to do this manually you would need to block an IP roughly every 5 seconds. And the IP Blacklist doesn’t sleep, you would need to find a few partners to work with you in shifts, as the updates are happening 7 days a week at all times of the day. And forget about holidays and vacations, the blacklist never stops working.

    This chart shows the number of IPs added by day for the month of August. As you can see, the number of additions dropped off sharply starting on August 27th. As we reported in the August WordPress Attack Report, we saw a dramatic drop-off in brute force attacks on the 27th and blacklist additions essentially mirrored that change.

    545,340 IPs Removed in August

    When we talk about blocking attackers, we almost always talk about adding new IPs to our list. If you’re managing a small list of IPs by hand, that’s probably not going to get you in much trouble. But when you’re managing a big list that’s used by thousands of site-owners worldwide you need to be really careful to remove IPs when they stop attacking. This is especially important because we know that attackers like to use compromised routers to attack WordPress sites, which we wrote about back in April. As soon as it’s clear that an IP has stopped attacking, we immediately remove it from the blacklist.

    In August an average of 17,591 IPs were removed from the blacklist each day. It’s no coincidence that is almost the same as the average number of additions, which was 17,353. Attackers are well aware that IP blacklists exist, so they cycle through IPs quickly in an attempt to evade them. That’s why IP blacklists need to be managed in real-time, blocking the bad guys as quickly as possible when they start attacking.

    The chart below shows the number of IPs removed by day for the month of August. There was a big drop-off in volume beginning on the 28th, the day after we saw volume drop for additions.

    How Long Do IPs Remain on the list?

    To answer this question we looked at IPs that were removed from the list during the month of August and calculated how many days they had been on the list at the time of removal. IPs that were on the list for less than 24 hours are in the “0” row.

    As you can see, a small percentage of IPs spend more than 24 hours on the list. It’s clear that attackers cycle through IPs quickly, most likely because they become much less effective after a day or two of use. The longest an IP was was on the list was 150 days. We also looked at time on the blacklist by number of hours and learned that the average time an IP address spends on the blacklist is just 10 hours.

    Do Attackers Reuse IPs?

    For this question we counted the total number of times IPs were added to the list during the month. It turns out that while attackers do re-use IPs, they don’t as often as you might think. Over two-thirds of the time IPs were added to the blacklist just once.

    Which Countries Dominate the Blacklist?

    Unlike the list of most active countries in our Monthly Attack Reports, which ranks countries based on total attacks, this list looks at the total number IPs that were added to the blacklist during the month for each country. The results might surprise you.

    Russia, the United States and Ukraine consistently dominate the top 3 in our Monthly Attack Reports. From this view, India and Brazil are at the top. In our monthly attack report, India and Brazil are generally towards the bottom of the top 10. Another surprise is that in this view, Ukraine isn’t even in the top 25.

    What this indicates is that India and Brazil see significantly more IPs being added and removed from our blacklist throughout the month. This indicates malicious activity that uses a larger number of IP addresses and that switches IP addresses frequently. This kind of activity is usually seen when attackers are using a botnet – a large number of machines that they control and use to launch a coordinated attack.

    The algorithm that we use to identify malicious IPs and add them to the blacklist includes logic that detects IPs that are part of a botnet and are engaging in a coordinated attack. These can be very hard to detect manually because each individual IP address only generates a small number of attacks on target websites.

    Which Organizations Do The IPs Belong To?

    By looking at the top 25 organizations that our newly blacklisted IPs belonged to in August we see a lot of the same telecom companies that we referenced in our post in April where we talked about the home router botnet attacking WordPress sites. Attackers clearly view vulnerable home routers as an attractive source of new IP addresses to launch attacks from.

    Conclusion

    While the blocking features in Wordfence are very popular and useful, the Real-time IP Blacklist feature included with Wordfence Premium is much more effective at protecting your site. Attackers are aware that IPs are eventually blocked so they cycle through them very quickly. For just $99 per year, which works out to just 27 cents a day, we’ll do the IP blocking for you.

    The post Staying Ahead of WordPress Attackers with the Real-Time IP Blacklist appeared first on Wordfence.

  • Display Widgets Plugin Includes Malicious Code to Publish Spam on WP Sites

    If you have a plugin called “Display Widgets” on your WordPress website, remove it immediately. The last three releases of the plugin have contained code that allows the author to publish any content on your site. It is a backdoor.

    The authors of this plugin have been using the backdoor to publish spam content to sites running their plugin. During the past three months the plugin has been removed and readmitted to the WordPress.org plugin repository a total of four times. The plugin is used by approximately 200,000 WordPress websites, according to WordPress repository. (See below)

    Wordfence warns you if you are using a plugin that has been removed from the repository. During the past months you would have been warned several times that this plugin has been removed with a ‘critical’ level warning that looks like this:

    It turns out that this plugin did have “unknown security issues”. Let’s start with a timeline of what happened to Display Widgets, why it was removed three times from the repository and allowed back in each time and then finally removed again a fourth time a few days ago.

    A Timeline of “Display Widgets” Bad Behavior

    On June 21st a plugin called Display Widgets was sold by its owner to a user known as ‘displaywidget’ on the WordPress.org forums. That new owner released version 2.6.0 of the plugin.

    On June 22nd, David Law, a UK based SEO consultant sent an email to the WordPress.org plugin team letting them know that the Display Widgets plugin was installing additional code from an external server. The plugin was downloading a large Maxmind IP geolocation database of around 38 megabytes from the author’s own server. This is not allowed for WordPress plugins in the repository.

    On June 23rd, the plugin team removed Display Widgets from the repository. There was some discussion about this on the WordPress.org forums.

    Then on June 30th, 7 days later, the developer released version 2.6.1 of the plugin. This release contained a file called geolocation.php which, no one realized at the time, contained malicious code. 

    The code in geolocation.php allowed the plugin author to post new content to any website running the plugin, to a URL of their choosing. They could also update content and remove content. Furthermore, the malicious code prevented any logged-in user from seeing the content. In other words, site owners would not see the malicious content.

    David Law again contacted the plugin team and let them know that the plugin is logging visits to each website to an external server, which has privacy implications.

    On July 1st the plugin was once again removed from the WordPress repository.

    On July 6th version 2.6.2 of Display Widgets was released and it again included the malicious code referenced above which had still gone unnoticed by anyone. It included a change to the logging code which was disabled by default and included an on/off option. At the time David Law let the WordPress.org plugin team know that this was not enough in his opinion and they ended up disagreeing on the issue.

    On July 23rd, Calvin Ngan opened a Trac ticket reporting that Display Widgets was injecting spammy content into his website. He included a link to Google results that had indexed the spam and said the malicious code is in geolocation.php.

    On the 24th of July the WordPress.org plugin team removed Display Widgets from the plugin repository for a third time.

    On the 2nd of September version 2.6.3 of the plugin was released and it included the same malicious code. Line 117 of geolocation.php in version 2.6.3 even contains a minor bug fix to the malicious code, which makes it clear that the authors themselves are maintaining the malicious code and understand its operation.

    On September 7th a forum user on WordPress.org reports that spam has been injected into their website on the Display Widgets plugin support forum.

    The author responds on September 8th saying:

    “thank you for letting me know. Yes, the last update fixed this you need to clear your cache and update to the latest version. As I mentioned in the changelog, I asked a friend of mine to review the code and he gave me a full report. You can look at the wp_options table for leftovers, and if you don’t find anything then you should be okay.”

    And then another reply from someone else sharing the same ‘displaywidget’ user account (spelling mistakes included):

    —

    Hi,

    The other admin here. Unfortunately the addition of the GEO Location made the software vulnerable to a exploit if used in conjunction with other popular plugins.

    The latest update fixed and sanitised the vulnerability. A simple empty of the cache & clearing of the wp_options table (if affected) should remove that post.

    Again i apologise. But this should fix it. We estimate only around 100 or so sites to be comprimised.

    Thanks

    DW

    —

    The malicious code is not an exploit. It is a backdoor giving the author access to publish content on websites using the plugin. It does not require ‘other popular plugins’ to work.

    The second poster says “only around 100 or so sites” are compromised. Actually, the backdoor exists on any site running versions 2.6.1 to version 2.6.3 of the plugin. Considering the time-span of 2.5 months between those releases, that would mean that these two or more people have access to publish anything they like on most of the 200,000 sites the plugin is installed on.

    On September 8th the plugin was removed for a fourth time from the WordPress plugin repository. This time we hope it is permanent.

    Wordfence Issued ‘Critical’ Alert Each Time Plugin Was Removed

    On June 15th of this year, Wordfence added a feature to alert you if a plugin is removed from the repository. We did this because in the past, plugins have been removed because they have a security issue. It turns out that this feature helped users recognize that there was a security issue with this plugin.

    We started alerting when this plugin was first removed, over two months ago:

     

    We then continued to alert as the plugin was removed from the repository and re-added several times, as is the case in this forum post:

    I’m incredibly proud that our team took the initiative and got this feature released in June of this year, just in time to save many of our free and paid customers from being affected by this malicious plugin.

    Could This Have Been Accidental?

    It is worth considering that the plugin author may have accidentally included an external library that contained someone else’s malicious code without realizing it. In fact the second poster on September 8th says:

    “Unfortunately the addition of the GEO Location made the software vulnerable to a exploit if used in conjunction with other popular plugins.”

    This suggests they used an external library and weren’t aware of the ‘vulnerability’.

    They were maintaining the malicious code

    The 2.6.3 release of their plugin makes a minor modification to the malicious code in geolocation.php to fix a bug in the code that lets the plugin author list the malicious posts they have published on your site.

    Then in the latest release there is a major change. They break out the code that is pulling down the spam into a separate function called endpoint_request() and switch to using the domain stopspam.io instead of using geoip2.io. Both domains are hosted on the same IP address. They also base64 encode the domain name in an attempt to hide the name of the domain they are fetching spam from.

    The authors of the plugin are actively maintaining their malicious code, switching between sources for spam and working to obfuscate (hide) the domain they are fetching spam from.

    The authors operate the domain the spam is fetched from

    On July 4th, one of the plugin authors says this in a post:

    “So I registered address geoip2.io to provide service for “unlimited” requests. I purchased ip2location Pachage for a project of mine a while ago, so I can use with no problem, as long as I do not sell similar service to ip2location.”

    The authors admit they registered and own the geoip2.io domain name. The stopspam.io domain which they later switch to is hosted at the same IP address which is 52.173.202.113.

    The authors were caught lying

    The authors of Display Widgets sold the plugin to the new plugin owners and have said so on their website.

    On approximately July 4th, one of the authors sharing the ‘displaywidget’ account posted that they did not buy the plugin, calling it “fake news”:

    “out of curiosity, where does it say that I purchased this plugin? See? This is exactly why people like Trump win: because of fake information being spread, and because of people who believe in anything they read without checking the reliability of those sources. I’d like to know where this rumor that “money was exchanged” started.”

    The former authors at Strategy11 have a clear message on their site saying that the plugin was ‘purchased’:

    Why would the new owners of the plugin lie about the plugin being purchased? Who knows, but it provides data showing that they are willing to lie publicly while accusing others of doing the same.

    Who is Behind Display Widgets and the ‘displaywidget’ Username?

    In the heat of an argument on the WordPress forms, one of the authors sharing the ‘displaywidget’ username includes the following in a post:

    “Please keep your own un-educated thoughts to your self and stop trying to advertise your FORK of the real plugin on my support pages. Instead please contact kevin.danna@wpdevs.co.uk and please provide who ever you contact, with that email address.”

    They sign the post “Kevin”.

    If you visit the ‘wpdevs.co.uk’ domain name you’ll find a site that wants to buy WordPress plugins:

    They claim to have “34 plugins and counting”. This suggests that whoever bought the Display Widgets plugin is operating this business. There is no further info about “Kevin Danna” or the business available.

    Which 34 plugins does this company own?

    This company and the individuals behind it appear to be responsible for injecting malicious code into a plugin used by over 200,000 websites. If they have 33 other plugins, we would like to know which they are. I reached out to the kevin.dana@wpdevs.co.uk email address and received a reply which I have included below. The reply suggests that the “34 plugins” claim may not be true. 

    Are they really based in the UK? 

    The company says that they are based in the UK on their home page. Their domain is also a UK domain name. And yet, one of the plugin authors said in a post on July 4th:

    “Apologies for the delay. Please consider that it is Independence Day weekend here in the United States, and even plugin developers deserve to spend some quality time with their families, don’t you think?”

    Is this another example of one of the authors lying? Or is one of them based in the United States and the company is based in the UK?

    A possible Russia linguistic connection

    I’m moving into the realm of speculation here, but something struck me as I was reading some of the plugin authors comments. These are extracts from the forum posts from the account that the two authors share. You can find all posts here.

    Notice the following phrases which I’ve extracted from posts by ‘displaywidget’. Everything in square parentheses has been added by me and was a linguistic error by the poster.

    • “so I can use [it] with no problem”
    • “as long as I do not sell [a] similar service to ip2location”
    • “have access to [the] IP addresses of those using [the] service”
    • “Why do I collect also [the] website URL?”
    • “websites are abusing of this free service”
    • “people think I [am] try[ing] to take advantage of something”

    This indicates that at least one of the individuals sharing the ‘displaywidget’ account is a non-native english speaker. It is a common mistake for Russians to omit the article when speaking english. That is the most common mistake made in the examples above.

    This may indicate that at least one of the authors is either based in eastern Europe or of eastern European origin.

    Kevin Replies to My Email

    I sent the kevin.danna@wpdevs.co.uk email address a request for comment on this story. I asked specifically about the wpdevs website claiming that he has 34 plugins and whether the code to add spam content was included intentionally. I received a reply. I am excluding the first four sentences which includes some personal detail. This is the rest of his reply:

    —Begin quoted email—

    *snip*… So i sold up all my plugins to numerous people.

    The Display Widgets plugin was sold to a company in California who made me sign a NDA. Probably due to the reasons you have highlighted. This is the only plugin i sold to this “guy”. He claims to have lots of “drupal” plugins and this was his first wordpress plugin. I bought this plugin for $15,000 and sold it for $20,000. They told me they was using it to advertise there toolbar, which i suppose you could use to search them up.

    In regards to the 34 plugins and counting, that was at the peak of my career. I would buy plugins brand them up towards say a “web design” business on the /wp-admin/ and then sell the web design business along with the plugin with words like “Used by over 100,000+ websites” adding words like that etc inflated the price of the business by xyz and then i would simply flip it as quick as i could. WP Devs is now a defunct company for obvious reasons.

    I apologise for any inconvenience i have caused in directly. I wish you the best of luck!.

    —end quoted email—

    I sent Kevin a follow-up request for more information. I pointed out that the wpdevs.co.uk domain was registered in April of this year according to Nominet. I also pointed out that archive.org have no record of anything on the domain prior to that.

    I’ll leave it up to the reader to draw your own conclusions.

    The Technical Functioning of Malicious Code in DisplayWidgets

    The most recent version of the plugin hooks into the ‘wp’ action which runs on each request to the WordPress front-end. When this hook is first run after the plugin’s activation, it makes a request to the spammer’s server to “check in” with the following parameters:

    http://stopspam[dot]io/api/update/?url=&agent=&v=1&p=4&ip=&siteurl=

    If we break that into bullets for readability it is:

    • url=
    • agent=
    • v=1
    • p=4
    • ip=
    • siteurl=

    This “check in” call acts to notify the spammer that a new site or installation can be configured to host backlinks or other spam content.

    The plugin has separate actions that allow an unauthenticated user (the spammer in this case) to create or update posts/pages at a user-supplied slug with content that is pulled down from the stopspam.io domain.

    The content that can be pulled down from the spammer domain includes script tags that could be used for an XSS attack. The attack would not be able to target logged-in users of the site because content is hidden from them. However, it could target users who are not logged in and gain access their sensitive data via an XSS attack.

    The following URLs can be accessed by the spammers (plugin authors in this case) to create, modify and delete content on a website running the affected versions of this plugin:

    As you can see, the authors have even included a convenient ‘bulk’ deletion function to remove all traces.

    The spammers were previously using the geoip2.io domain to fetch spam. They later switched to stopspam.io and neatened up their code slightly. The spammers have several domains they are using, all hosted at the same IP address 52.173.202.113:

    • stopspam.io registered July 2, 2017.
    • geoip2.io registered 24 July, 2017.
    • w-p.io registered 11 July, 2017
    • maxmind.io registered 24 July, 2017

    Wrapping It Up

    As I mentioned in the introduction, Wordfence would have warned you each time this plugin was removed from the repository. It is important that you have Wordfence installed and have your email alerts configured. Make sure you pay attention and respond when needed. We have several reports from users who say they did respond to this Wordfence alert and removed the malicious plugin.

    You are welcome to share your thoughts in the comments. Please note that many of the forum moderators and plugin repository maintainers are volunteers. Please do not judge them harshly – in general they do a pretty darn good job of keeping an extremely large repository and support forum system running smoothly for the most popular CMS on earth.

    I would also ask you to not start any witch hunts. I’m sure some folks are angry about what transpired here, but things happen and if you were on top of security, you would have been notified that the plugin was removed from the repository and you would have removed it from your site. Occasionally plugins change ownership and very rarely, that doesn’t go well. That appears to be what happened in this case.

    Mark Maunder – Wordfence Founder/CEO.

    Credits

    A number of people contributed to this post. Firstly I’d like to thank David Law. He was the first person to raise a concern about this plugin and pursued his case relentlessly on the WP forums with, at times, resistance from the plugin authors and others. Thanks David for looking out for the rest of us. David was also kind enough to exchange several lengthy emails with me to help establish a timeline – one of them was at 5am his time.

    I’d also like to thank Matt Barry, Brad Haas, Kathy Zant, James Yokobosky, Dan Moen, Asa Rosenberg and Matt Rusnak on our team, for their assistance with this post.

    I also tried to contact Stephanie Wells, the original author of the plugin via her website and via LinkedIn and she was not immediately available for comment.

    UPDATE: I just completed a Skype call with Stephanie, the original author of the plugin. She has been incredibly open and honest about this whole situation. They (she runs a business with her husband) are good people and she freely shared data with me that will help tremendously with our investigation. Stephanie clearly cares deeply for the WordPress community and security in general. I can tell she is deeply disappointed by how this worked out and wants to do everything she can to help. My team and I are still processing the data she shared, but will most likely post a follow-up.

    The post Display Widgets Plugin Includes Malicious Code to Publish Spam on WP Sites appeared first on Wordfence.