Balada Injector Exploits Popup Builder XSS to Compromise Thousands of WordPress Sites
Active Exploitation · 2 sources · Updated 1mo ago · First seen Jan 9, 2024
Balada Injector exploited CVE-2023-6000, an unauthenticated stored cross-site scripting vulnerability in the WordPress Popup Builder plugin, to compromise thousands of websites. The flaw, rated CVSS 8.8, stemmed from inconsistent POST parameter handling and missing capability checks in a post-previewing function. Popup Builder 4.2.3, released December 7, 2023, fixed the vulnerability, but exploitation began December 13, shortly after public disclosure. PublicWWW identified the campaign’s injection on more than 6,200 websites; Sucuri SiteCheck detected the malware on more than 3,000 sites during the first week of January 2024.
Attackers injected JavaScript into popup event handlers to redirect visitors to scams and abuse authenticated administrator sessions to install a hidden malicious plugin, wp-felody.php. The plugin enabled arbitrary PHP execution and planted additional infections in wp-blog-header.php, including on neighboring websites sharing the same server account. Campaign infrastructure included specialcraftbox[.]com and greenfastline[.]com, which subsequently moved from behind Cloudflare to a server in Moldova. Administrators must update vulnerable installations and remove existing backdoors; patching alone does not clean compromised sites, and other websites under the same hosting account also require inspection.
