Critical Malware Campaign Exploits WP-Automatic Plugin Vulnerability in Over 5 Million Attacks

The WP-Automatic plugin, widely used for content automation in WordPress, has become the target of a large-scale malware campaign exploiting a critical SQL injection vulnerability. Since its public disclosure in March 2024, this flaw has enabled attackers to gain unauthorized admin access, upload malicious files, and maintain persistent control over compromised WordPress sites.

Details of the WP-Automatic Vulnerability

The vulnerability centers on an SQL injection (SQLi) flaw found in the user authentication process of the WP-Automatic plugin, which automates content posting by scraping and importing articles. Specifically, the plugin’s csv.php file improperly handles input, allowing attackers to inject arbitrary SQL queries that bypass authentication checks.

This flaw, tracked as CVE-2024-27956, scores 9.8 out of 10 on the CVSSv3.1 scale, indicating a critical severity level. Exploiting it grants attackers the ability to create new admin-level user accounts within WordPress, a direct path to full site takeover.

From a WordPress security standpoint, this is particularly dangerous because admin privileges allow installing plugins or themes, editing code, and modifying site settings. This vulnerability can therefore lead to widespread site defacement, data theft, or use of the site as a malware distribution platform.

How Attackers Exploit This Vulnerability

The attack sequence typically follows these steps:

• SQL Injection: Attackers send specially crafted requests targeting the vulnerable csv.php file to execute unauthorized SQL commands.
• Admin User Creation: Using SQL injection, they add new admin accounts to WordPress, often with names starting with xtw, to mask their presence.
• Malware Upload: With admin access, attackers upload malicious scripts such as web shells or backdoors to maintain control.
• File Renaming: To evade detection, attackers rename the vulnerable plugin file, for example, changing csv.php to csv65f82ab408b3.php, complicating cleanup efforts.
• Persistence: They install additional plugins or themes that facilitate file uploads or code editing, ensuring ongoing access even after initial detection.

From experience managing compromised WordPress sites, this pattern of renaming plugin files is a common tactic to avoid signature-based detection by security plugins or manual inspections. It also indicates attackers’ intent to monopolize control of the site, preventing other threat actors from exploiting the same vulnerability.

Attack Campaign Scale and Timeline

Since PatchStack’s public disclosure of the vulnerability on March 13, 2024, WPScan has logged more than 5.5 million attack attempts globally. The campaign started gradually but peaked around March 31st, indicating automated bots scanning and attacking vulnerable sites en masse.

Sites running WP-Automatic versions earlier than 3.9.2.0 and lacking strong security monitoring are most at risk. Shared hosting environments or multisite WordPress networks with multiple plugins installed often see faster compromise due to less stringent isolation and resource constraints.

Mitigation and Protection Strategies

Protecting WordPress sites from this active threat requires immediate and multi-layered action:

• Update WP-Automatic: Upgrade to version 3.9.2.0 or later, where the SQL injection vulnerability is patched. This is the most direct and effective defense.
• Audit User Accounts: Review WordPress admin users for suspicious accounts, especially those with unusual usernames like xtw. Remove any unauthorized users promptly.
• Security Scanning: Use security tools such as Jetpack Scan to detect malicious files and unauthorized changes. Jetpack users should enable the Enhance Protection feature, activating Web Application Firewall rules that inspect requests to standalone PHP files like csv.php.
• Backup Regularly: Maintain reliable, frequent backups to enable quick recovery if compromise occurs. Offline or remote backups reduce risk of malware encrypting backups as well.
• Monitor File Integrity: Employ plugins or services that alert on unexpected file modifications or renaming within the wp-content/plugins/wp-automatic directory.

Indicators of Compromise WordPress Site Operators Should Watch For

Signs that a site has been compromised by this campaign include:

• New administrator users with names beginning with xtw.
• Renamed plugin files within wp-content/plugins/wp-automatic/inc/, such as csv65f82ab408b3.php instead of the original csv.php.
• Presence of suspicious PHP files with SHA1 hashes b0ca85463fe805ffdf809206771719dc571eb052 (web.php) or 8e83c42ffd3c5a88b2b2853ff931164ebce1c0f3 (index.php) dropped in the site filesystem.

Since attackers often use such files as backdoors or web shells, their discovery mandates immediate incident response and site cleanup.

What This Means for WordPress Users

We must treat the WP-Automatic vulnerability as a high-priority security incident. Sites running outdated versions are under active attack and can be fully compromised within minutes of exposure. For agencies managing multiple client sites or hosting providers supporting WordPress environments, this vulnerability demands rapid patch deployment and increased monitoring.

This campaign highlights the ongoing risk of third-party plugin vulnerabilities in WordPress. Unlike WordPress core, plugins can vary in code quality and update frequency, creating persistent attack surface. For most WordPress agencies, the bigger concern is how quickly attackers exploit published vulnerabilities at scale, often before patch adoption completes.

From experience, sites with more than 20 active plugins or those on shared hosting tend to suffer faster compromise because patch delays and limited monitoring increase exposure. Managed WordPress hosting providers can mitigate risk by proactively blocking vulnerable plugin files via Web Application Firewalls or offering automated plugin updates.

Moving forward, we expect more attackers to combine SQL injection with privilege escalation to maintain persistence, emphasizing the need for layered security controls beyond just patching. This includes regular user audits, file integrity monitoring, and Web Application Firewalls capable of blocking suspicious PHP file access.

Related News

• More Articles