A case of a fake WordPress vulnerability patch being distributed has been uncovered. This fake security patch is malware, and there are currently reported cases of emails to WordPress administrators containing links to this malware.


Overview of fake security patches that talk about CVE-2023-45124

This malware sends an email (phishing email) to WordPress administrators, urging them to apply a fake security patch with the following wording

"The WordPress Security Team has discovered a Remove Code Execution (RCE) vulnerability on your site, which allows attackers to execute malwares and steal your data, user details and more ..."

If you click on the link in the email
It will prompt you to download and install a plugin called CVE-2023-45124 Patch.

The page looks similar to the official WordPress site, and according to Sucuri, it has been confirmed to lead to the following domain

en-ca-wordpress[.]. org
en-za-wordpress[.] org org
en-nz-wordpress[.]] org
en-au-wordpress[.]] org
en-gb-wordpress[.]] org
en-us-wordpress[.]] org
wordpress.secureplatform[.]. org
wordpress.secureplugins[.]. org

The fake patch appears to be a zip file plugin with the following name
wpgate[.]. zip
wpsrv[.] zip zip
wpsys[.] zip zip
wpops[.]] zip

How to deal with

WordPress security patches are distributed through automatic updates to WordPress itself. They are never distributed as a plugin.

Ignore phishing e-mails that suggest you install a plugin as a security patch. Do not click on any links.

What if I have already installed it or may have?

Go to the WordPress admin page > Plugins > Plugins list and stop and remove the plugin WordPress Patch CVE-2023-45124 (or a similarly named plugin) if it exists.

We also recommend that you perform a malware scan and removal and security measures.

Free WordPress:Malware Scan & Security Plugin [Malware and Virus Detection and Removal].

Related Posts:

  1. Serious Vulnerability in WordPress Jetpack Plugin
    A serious vulnerability has been discovered in the Jetpack plugin for WordPress and a version update has been distributed. This section explains how to deal with this vulnerability....
  2. Malware that displays a fake WordPress login screen and steals login information
    Recently, malware that alters the JAVASCRIPT file of WordPress and uses it as a parasite to display a fake login screen and steal login information has been spreading....
  3. WordPress malware Redirect to fake login page
    Recently, there have been an increasing number of cases of malware that direct users to a new type of fake login page. We will explain this malware....
  4. WordPress malware Fake browser update page
    Recently there has been an increase in WordPress malware that displays a fake browser update page. We will explain this malware....
  5. WordPress Security Improvement Plugin Vulnerability Edition
    One of the most common methods of WordPress hacking is to exploit plugin vulnerabilities. Plugin vulnerabilities can range from serious to minor, such as a link in a spam email that redirects the user. In this article, we will discuss the most serious vulnerability, called “arbitrary file upload,” which allows external parties to upload files directly to your server, and...
  6. WordPress malware, heck.php showing fake Google login screen
    Recently, many websites have been defaced to display fake Google login screens, and we will provide examples and explanations of these defacements....