Public
- Public
- Network
- Groups
- Featured
- Popular
- People

The fake message from Wordpress says the WP security team discovered a remote code execution flaw in your site, and that Wordpress has made available a patch for the flaw - CVE-2023-45124 -- which doesn't exist. The "patch" is actually a website backdoor.

Download link

The fake message from Wordpress says the WP security team discovered a remote code execution flaw in your site, and that Wordpress has made available a patch for the flaw - CVE-2023-45124 -- which doesn't exist. The "patch" is actually a website backdoor.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/522/256/557/597/447/original/455a08d6dde9631f.png

Notices where this attachment appears

Embed this notice
BrianKrebs (briankrebs@infosec.exchange)'s status on Monday, 04-Dec-2023 23:17:34 JST BrianKrebs

This is pretty clever. A phish going around spoofing Wordpress and telling people to install a security update that references a fake CVE. In this case, the "patch" is a website backdoor.
https://www.wordfence.com/blog/2023/12/psa-fake-cve-2023-45124-phishing-scam-tricks-users-into-installing-backdoor-plugin/

In conversation about a year ago from infosec.exchange permalink