WordPress sites using this plugin are in danger!

A vulnerability in a little-known but used WordPress plugin is being used to steal users’ payment information by installing malicious code. Experts warn site owners against this danger.

Watch out for little-known WordPress plugin Dessky Snippets

WordPress plugin Dessky Snippets allows site administrators to add custom PHP code to their sites. However, the vulnerability of this plugin is used by attackers to install malware by looking for active installations on websites with online stores.

This attack, detected by cybersecurity research company Sucuri, allows attackers to inject their own code by manipulating the WooCommerce payment process. Sucuri researchers stated that this malicious code was recorded in the dnsp_settings option in the WordPress wp_options table and modified the payment form, adding additional forms that asked customers for information such as name, address, credit card number, expiration date and CVV number.

It is also noteworthy that the autocomplete feature is disabled in these fake forms. Even if autocomplete is turned on in their browser, users do not receive any warnings on these forms and must fill in the fields manually. This makes the forms look organized and necessary information, making users unsuspecting.

WordPress is targeted by cybercriminals because it is the most popular website creation platform. However, since the platform is generally considered secure, attackers are turning their attention to less secure plugins and themes.

WordPress users should be careful when using unknown or little-known plugins on their sites and be alert for security vulnerabilities. Plugins used in payment transactions, in particular, are attractive targets for cybercriminals, and such attacks can compromise users’ financial information.

The first step to improving security on your WordPress site is to make sure all the plugins and themes you use are up to date. It is also important not to download plugins and themes from unreliable sources.

You can protect your site and your users by performing regular security scans and being aware of vulnerabilities. Remember, online security requires not only software but also users to be careful and aware.