wpmudev-hub= Website Compromise

We’ve noticed that there appears to be a website compromise/hack affecting one of our sites that starts with Forminator. The steps we’ve identified that this compromise takes is that someone accesses the wpmudev-hub= query string on the homepage, for example from our access.log:

"POST /?wpmudev-hub=34d20c002dbd1084-178623507923291 HTTP/2.0"

The exact value given may change with different calls to this query string key. That key is found inside the following files in Forminator, making us suspect a flaw in Forminator is the root cause:

• ./library/lib/hub-connector/inc/class-admin.php
• ./library/lib/hub-connector/inc/class-remote.php

Immediately following that request is this:

"GET /wp-content/plugins/background-image-cropper/accesson.php HTTP/2.0" 200 11 "https://example.com/?wpmudev-hub=34d20c002dbd1084-1786235079232913"

The background-image-cropper plugin was not on our site until the moment of the request with wpmudev-hub=.

The second request will place the accession.php file, which appears to be a shell, at the root of our website. From there, the compromise can do basically anything.

We’ve just blocked the wpmudev-hub= in Cloudflare to aim to nip this in its rear end (since we’re just using the free version of Forminator there is no need for that query string we believe), but the code that enabled it is still in Forminator.

Before that latest attempt to block this, which we just did so not much data about success, we had instructed nginx to disallow access to the accession.php file, as well as stuff inside the background-image-cropper plugin using config such as:

location ~* /wp-content/plugins/background-image-cropper/.*\.php$ {
    deny all;
    return 403;
}
location ~* /accesson\.php$ {
    deny all;
    return 403;
}

Our server also has the following in its php.ini that would have helped limit the damage the shell could do:

disable_functions = disk_free_space,disk_total_space,diskfreespace,dl,exec,opcache_get_configuration,opcache_get_status,passthru,pclose,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_waitpid,pcntl_wait,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,show_source,system

Still, we believe Forminator’s code related to the hub connector is the original backdoor, and so wanted to report this here both to WPMU Dev, and so that other users can see it. We strongly encourage this compromise path get fixed ASAP.

• This topic was modified 5 days, 10 hours ago by Alexander Celeste.