5 INFECTED WP/Woo themes JUL 2023 | Supply chain attack

DISCLAIMER: these INFECTED WP/Woo themes JUL 2023 are critical security vulnerabilities, that are self-inflicted. As an admin, an employee or owner – anyone can upload to their hosting environment an infected file as the latest archive of YOUR WP/Woo theme. Trusting a simple file download, even for a well-known source, developer or marketplace is not a safe bet lately. Please scan all your uploads before they reach your hosting server.

Who is to blame for the INFECTED WP/Woo themes JUL 2023?

This is where things get a bit tricky. Paranoia is activated and ZERO TRUST is enforced.

The first link is the development team itself. When contacted, they have no idea how their archive got infected, and they always immediately provide clean archives via other AND DIRECT channels, such as email, file sharing during an online chat, or secure cloud storage providers. As this has happened to several individuals and companies we have worked with over the years – they remain on the suspect list, but considering their innocence, they have more to lose than to gain with unethical approaches like this.

The second link is their hosting provider, which takes many forms based on individual business decisions. Some use their own environment and blame their own hosting. Fresh hosting antivirus scans never reveal anything. The conspiracy only raises more questions than it answers. Since this is becoming more and more common, we decided to just inform the owner and let them figure out how a clean archive got infected after upload.

The third link are marketplaces, where all control is lost, for both parties involved: seller and buyer. The developer (the so called seller) simply uploads his products, and you and I as customers, (the so called buyers), simply order those products. Once payment is confirmed, the direct download link is provided and you download the uploaded WP/Woo themes. As the majority of these downloads are always personalised with a unique link, so one customer could not give another customer the same download link to a product they have not paid for – it makes you even more paranoid. Why is my marketplace trying to infect me? Questions that always hit a brick wall, with polite but succinct disclaimers that this sort of thing can happen from time to time.

And we agree. From time to time, these annoyances do happen. But when we see multiple attempts to infect us and our customers on a weekly basis, then IT IS SUSPICIOUS. If it happens several times with the same product in a single month, then IT IS PARANOIA. If it happens across multiple personal and business accounts, across multiple channels, across multiple links in the supply chain (developers, storage providers, marketplaces, CDNs), then IT IS PERSONAL.

Ethical online business is something we all want, but nobody does. And most importantly, by our silence, we allow free reign to those who think they can do anything, get anything, by lurking in the shadows. We simply want to raise awareness. Hopefully you, dear reader, will understand to scan all WP/Woo themes BEFORE you upload them to your WordPress and WooCommerce.