c/side Won't Protect WordPress Websites From Being Hacked

The WP Security Minute for March 7, 2025.

Yesterday, The Hacker News ran a story titled "Over 1,000 WordPress Sites Infected with JavaScript Backdoors Enabling Persistent Attacker Access." The story was missing a key detail and the story's source seemed to be trying to mislead WordPress webmasters about how to protect their websites from being hacked.

The story referred to this as an attack happening against WordPress websites, but what was being described was the result of an attack having already happened. The attack caused malicious JavaScript code to be loaded from another website. The story and the sole source cited were silent on how that happened.

A posting on the official WordPress support forum from December appeared to reference the same malware being on a website. That was being placed in a sitemap, so the attacker must have already been able to place malicious code on the website or inject it in to the database.

The source for the story, a security provider named c/side claimed that they had "successfully detected and blocked the malicious JavaScript injection" and claimed that "our system can provide real-time analysis and proactive defense." But what they were referring to was something that would happen after the original attack had been successful, which they didn't stop.

If you know how the original attack happened comment below.

The mention of the cdn.csyndication.com malware on the official WordPress support forum can be found at https://wordpress.org/support/topic/xml-sitemap-error-xml-declaration-only-allowed-at-start/

Видео c/side Won't Protect WordPress Websites From Being Hacked канала WP Security Minute