Urgent Security Advisory: WordPress Popup Builder Exploitation – Take Immediate Action
Last updated:
Hackers are exploiting a vulnerability (CVE-2023-6000) in outdated versions of the Popup Builder plugin for WordPress, infecting over 3,300 websites. This cross-site scripting (XSS) flaw affects Popup Builder versions 4.2.3 and older, initially disclosed in November 2023. Despite a prior Balada Injector campaign affecting 6,700 websites, a new surge has been observed in the past three weeks, indicating delayed patching by site administrators.
The attacks target the ‘wp_postmeta’ database table, infecting Custom JavaScript or Custom CSS sections in the WordPress admin interface. The injected code serves as event handlers for Popup Builder plugin actions, leading to various outcomes, including redirecting visitors to phishing pages and malware distribution sites.
Sucuri reports 3,329 WordPress sites affected, with 1,170 infections detected by its scanners. Malicious domains include “ttincoming.traveltraffic[.]cc” and “host.cloudsonicwave[.]com,” recommended for blocking.
To defend against these attacks:
- Upgrade Popup Builder to the latest version (4.2.7), addressing CVE-2023-6000 and other security issues.
- Block domains “ttincoming.traveltraffic[.]cc” and “host.cloudsonicwave[.]com.”
- For infected sites, remove malicious entries from Popup Builder’s custom sections and scan for hidden backdoors to prevent reinfection.
Considering that over 80,000 active sites still use Popup Builder 4.1 and older, prompt action is crucial to mitigate the risk of further exploitation.
Request an IT assessment
Tell us a little about your business and a PDX IT team member will follow up to schedule an assessment. Prefer to talk? Call 971-331-4871.
About the author: Steve Shaff
Steve Shaff is the owner of PDX Information Technology Services, a managed IT provider he founded in 2020. From the Tualatin office he helps businesses across Portland Metro & Southwest Washington with IT support, cybersecurity and compliance. More about Steve ยท Contact PDX IT
Modern ransomware gangs don’t just lock your files. They copy your data first, then threaten to publish or sell it on the dark web. Here is how double extortion works and what Portland-area small businesses can do before, during and after an attack.
Portland small business mobile security checklist: lock phones, avoid risky public Wi-Fi, secure office wireless, spot text scams and handle lost phones.
Portland employee offboarding IT checklist: lock Microsoft 365, save the mailbox and OneDrive files, change shared passwords and wipe company devices.