Open Source · · 3 days

Blaze Widget plugin created backdoors

Malicious code was injected directly into the Blaze Widget plugin repository on WordPress.org.

Part of WordPress.org plugins created admin backdoors campaign

Blaze Widget was one of the five plugins Wordfence tied to the June 2024 WordPress.org source compromise. The attacker did not create a fake package; the malicious code landed in the official plugin distribution path.

The official CVE lists Blaze Widget versions 2.2.5 through 2.5.2 as infected. Immutable repository evidence extends the observed lower bound to 2.2.4: revision 3105768 still declares 2.2.4 but adds the campaign command-and-control logic to the previously clean file. Sites updating through WordPress.org could receive the poisoned plugin.

The shared payload tried to create an administrator account and send credentials to 94.156.79.8. It also injected footer JavaScript for SEO spam, turning a plugin update into both an account-takeover path and a search-spam foothold.

This record keeps the Blaze Widget versions separate from the broader campaign because cleanup depends on the exact plugin slug and version range. The campaign page carries the shared WordPress.org compromise pattern and cross-plugin indicators.

Appendix · Affected releases

blaze-widget wordpress fixed 2.5.4
2.2.4 sha256 271117a4…59a80b3c download unavailable
2.5.2 sha256 28e145ad…775353c6 download unavailable
  • The CVE's 2.2.5 lower bound is contradicted by immutable SVN revision 3105768, whose plugin header says 2.2.4 and whose source contains the campaign C2 logic. Revision 2268477 is the preceding clean 2.2.4 file, revision 3106494 is malicious 2.5.2, and revision 3106796 is clean 2.5.4.

Indicators

  • file_sha256blaze-widget-r3105768-blaze_widget.php 271117a4501b9eb5153d3ad65afd7ac07be2f59fabd67fbaa676d8e059a80b3c
  • file_sha256blaze-widget-r3106494-blaze_widget.php 28e145ad13289cbd819ce730f673b27c8b9d49c5488a3796de24eb0f775353c6

References

  1. Supply Chain Attack on WordPress.org Plugins Leads to 5 Maliciously Compromised WordPress Pluginswordfence.com
  2. CVE-2024-6297 recordcveawg.mitre.org
  3. Various Plugins - Injected Backdoorwpscan.com

Source record: oss/attacks/wp-blaze-widget/meta.yaml