Contact Form 7 addon created backdoors

Contact Form 7 Multi-Step Addon was part of the same June 2024 WordPress.org plugin campaign. The compromise sat in the official plugin repository, so normal update behavior delivered the malicious code.

Wordfence identified versions 1.0.4 and 1.0.5 as infected and reported no patched version when it published. The correct response was removal or replacement until a safe release existed.

The shared malware tried to create new administrator users and report credentials to 94.156.79.8. It also placed SEO-spam JavaScript in the site footer, giving the attacker persistence and monetization from the same plugin update.

This record captures the Contact Form 7 add-on artifact, not the whole campaign. The package-level boundary matters because site owners had to search for this specific slug and infected version pair, not merely for any WordPress compromise.

Motive

Seo Spam Account Takeover

Attribution

Group

Cause

Malicious Injection

Transitive

No

Actor

Third Party

• Supply Chain Attack on WordPress.org Plugins Leads to 5 Maliciously Compromised WordPress Pluginswordfence.com